T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- handler.py:5
- Finding
- Unrestricted Server-Side Request Forgery Through User-Controlled URLs<![CDATA[ ## Vulnerability Details **File Location**: `handler.py:5, 25-27` **Vulnerability Type**: Server-Side Request Forgery (SSRF) **Risk Level**: High ### Vulnerable Code ```python def analyze_seo(url: str) -> dict: try: resp = requests.get(url, timeout=10) ``` ```python def handle(input_text: str, user_id: str = "default") -> dict: url = re.search(r'https?://[^\s]+', input_text) if not url: return {"error": "Please provide a URL"} return analyze_seo(url.group(0)) ``` ### Technical Analysis The handler extracts an arbitrary HTTP or HTTPS URL from attacker-controlled input and passes it directly to `requests.get()`. It does not validate the destination hostname, resolved IP address, network range, port, or redirect chain. The timeout only limits request duration; it does not prevent access to loopback addresses, private networks, link-local services, cloud metadata endpoints, or other resources reachable from the execution environment. Because redirects are followed by `requests` by default, checking only the initial URL would also be insufficient. The implementation reads the full response body through `resp.text` without imposing a maximum response size. This creates an additional resource-exhaustion risk when a remote server returns an excessively large response. ### Attack Path 1. An attacker submits an SEO request containing a URL that targets an internal or privileged endpoint, such as a loopback address, RFC 1918 address, or link-local cloud metadata service. 2. `handle()` accepts the URL because it only verifies that the string begins with `http://` or `https://`. 3. `analyze_seo()` causes the Skill host to issue the request from its own network context. 4. The target response is loaded into memory and parsed. 5. Extracted title, description, and heading data—or network and application details contained in returned errors—may be exposed to the attacker. 6. The attacker can repeat the process against different hosts ...[truncated 1063 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Permit only destinations required for the Skill's legitimate operation; an explicit hostname allowlist is preferable. - Resolve the hostname before connecting and reject loopback, private, link-local, multicast, unspecified, reserved, and other non-public IP ranges for both IPv4 and IPv6. - Protect against DNS rebinding by ensuring that the validated address is the address actually used for the connection. - Restrict allowed schemes to HTTPS where possible and reject embedded credentials or nonstandard ports unless specifically required. - Disable redirects, or validate the scheme, hostname, port, and resolved IP address of every redirect target before following it. - Enforce outbound firewall or proxy rules that prevent access to internal networks and cloud metadata addresses. - Stream responses and stop reading after a conservative maximum byte limit. - Validate the response content type before parsing it as HTML. - Use separate connection and read timeouts and impose limits on redirect count. - Return generic errors to users rather than raw exception strings that may disclose internal network details. ]]>