T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/fetch.js:45- Finding
Unrestricted URL Fetching Enables Server-Side Request Forgery
- Content
View full analysis
{ const protocol = url.startsWith('https') ? https : http; const options = { headers: { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36', 'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8', 'Accept-Language': 'zh-CN,zh;q=0.9,en;q=0.8' } }; const req = protocol.get(url, options, (res) => { let data = ''; res.on('data', (chunk) => { data += chunk; }); res.on('end', () => { resolve(data); }); }); ``` The input reaches this code without security validation: ```javascript async function processLink(url, options = {}) { console.log(`Processing link: ${url}`); try { const content = await fetch.fetchContent(url); ``` ### Technical Analysis The application performs an HTTP request to a caller-supplied URL without validating the destination. It does not enforce a strict scheme allowlist through structured URL parsing, resolve and inspect the destination IP address, or reject loopback, private, link-local, multicast, and reserved address ranges. The platform-recognition logic does not provide a security boundary. Unknown destinations are handled by the generic fetching strategy and therefore remain reachable. An attacker can consequently direct the process to HTTP services that are inaccessible from the attacker's own network but accessible from the environment running the Skill. The implementation also lacks controls against DNS rebinding. If redirect support is added ...[truncated 1378 chars]- Remediation
View remediation