T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/store-scanner.mjs:34- Finding
SSRF Protection Bypass Through Unvalidated Redirects and Incomplete IP Filtering
- Content
View full analysis
= 16 && Number(hostname.split(".")[1]) <= 31) ) { throw new Error(`Access to private address "${hostname}" is blocked.`); } return parsed.href; } catch (err) { throw new Error(`Invalid or unsafe URL "${value}": ${err.message}`); } } ``` ```javascript async function fetchWithTimeout(url, opts = {}) { try { validateSafeUrl(url); } catch (e) { throw e; } const controller = new AbortController(); const timer = setTimeout(() => controller.abort(), TIMEOUT_MS); try { const res = await fetch(url, { ...opts, signal: controller.signal, redirect: 'follow' }); return res; } finally { clearTimeout(timer); } } ``` ### Technical Analysis The scanner accepts a user-selected URL and attempts to prevent access to private services by inspecting the URL hostname before making an HTTP request. This protection is incomplete. The filter only rejects a subset of literal IPv4 representations. It does not comprehensively reject: - IPv4 link-local addresses, including cloud metadata services such as `169.254.169.254`. - IPv6 loopback, private, link-local, mapped IPv4, multicast, and reserved addresses. - Alternative ...[truncated 2689 chars]- Remediation
View remediation