T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/deep_search.py:1367- Finding
Server-Side Request Forgery Through Inadequate WeChat URL Validation
- Content
View full analysis
Optional[WechatArticle]: """获取微信公众号文章内容""" wechat_url = url if 'weixin.sogou.com' in url: wechat_url = self._extract_wechat_url_from_js(url) if not wechat_url: return None resp = self.session.get(wechat_url, timeout=30) ``` ```python def is_wechat_url(text: str) -> bool: """检测是否为微信公众号链接""" return 'mp.weixin.qq.com' in text and ('/s' in text or '/s?' in text) def fetch_wechat_url(url: str, json_output: bool = False) -> str: """直接获取微信公众号文章内容""" print(f"📱 直接解析微信链接: {url}") fetcher = WechatFetcher() article = fetcher.fetch_article(url) ``` ### Technical Analysis The application determines whether user input is a WeChat article URL by checking for the substrings `mp.weixin.qq.com` and `/s`. It does not parse the URL or verify that its actual hostname is exactly `mp.weixin.qq.com`. After this weak check succeeds, `fetch_article()` passes the original user-controlled value directly to `requests.Session.get()`. An attacker can therefore construct a URL whose path, query string, or user-information component contains the required substrings while its destination points to another host. For example, a URL shaped like the following can satisfy the substring checks while targeting a local service: ```text http://127.0.0.1/private/mp.weixin.qq.com/s ``` The `requests` library also follows redirects by default. Consequently, even an initially permitted destination could redirect the request to a loopback, private-network, link-local, or cloud metadata address unless every redirect target is independently validated. ### Attack Path 1. An attacker supplies a crafted value as the positional `keyword` argument. 2. The value contains `mp.weix ...[truncated 1576 chars]- Remediation
View remediation