T09 · Insecure Skill Coding Practices
- Location
SKILL.md:70- Finding
Unrestricted Remote Image Retrieval May Enable SSRF
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 70-78 and 217-218
Vulnerability Type: Server-Side Request Forgery (SSRF) through unvalidated image retrieval
Risk Level: MediumVulnerable Code Snippet
markdown 3. 封面处理： - 如果文章中有图片：下载图片文件，调用 `/api/common/applyUploadTempFile` 获取 `putUrl` 和 `path`，再使用 `putUrl` 上传到 COS，最后将该 `path` 作为 `/api/articleManage/create.coverFilePath`。 - 如果文章没有图片：`/api/articleManage/create.coverFilePath` 传空。 4. 处理正文图片（逐张执行）： - 先解析正文 HTML，找出所有图片地址（包含 `img data-src`、`img src`、`srcset`）；同一 `img` 若同时存在 `data-src` 与 `src`，优先使用 `data-src`（`src` 作为兜底）； - 对每一张图片分别下载文件； - 对每个图片文件调用 `/api/common/editorApplyUploadFile`，获取该图片对应的 `putUrl` 和 `url`； - 使用该 `putUrl` 将图片文件上传到 COS；The same unsafe behavior is reiterated at lines 217-218:
markdown - 正文HTML如有 `<img>` 图片标签：需识别 `img data-src`、`img src`、`srcset`；同一 `img` 同时存在时优先取 `data-src`，逐张转存到 COS 后用返回 `url` 替换该标签图片地址；替换后统一写回 `img src`，并避免保留外站 `data-src/srcset`，需保留原标签的 `style`。 - 发布前建议检查图片“发现数量”和“替换数量”是否一致。Technical Analysis
The publication workflow instructs the Agent to extract image locations from attacker-influenced HTML and download every referenced resource. It does not impose restrictions on:
- Permitted URI schemes
- Destination hostnames or IP addresses
- Private, loopback, link-local, multicast, or reserved address ranges
- Cloud instance metadata endpoints
- DNS rebinding or destination changes after resolution
- Redirect destinations
- Response size, download duration, or redirect count
- Expected image MIME types or actual file signatures
- URLs containing embedded credentials
Consequently, an attacker able to supply article HTML could place a sensitive destination in an
img,data-src, orsrcsetattribute. The Agent may then make the request from an environment with greater network access than the attacker possesses. The subsequent instruction to upload the retrieved file to COS could create a path for extracting the response.The ...[truncated 1994 chars]
- Remediation
View remediation
Remediation Suggestions
- Permit only
httpsimage URLs and reject all other schemes, includingfile,ftp,data,gopher, and custom schemes. - Reject URLs containing embedded user information or credentials.
- Resolve destination hostnames before connecting and block loopback, private, link-local, multicast, documentation, carrier-grade NAT, and other reserved address ranges for both IPv4 and IPv6.
- Explicitly deny cloud metadata hosts and addresses, including link-local metadata endpoints.
- Revalidate the resolved destination for every redirect and limit the number of redirects.
- Where operationally practical, restrict retrieval to an allowlist of trusted image hosts or require explicit user confirmation before contacting an untrusted host.
- Protect against DNS rebinding by connecting only to the validated resolved address while preserving the expected TLS hostname verification.
- Set strict connection and read timeouts, maximum response sizes, and concurrency limits.
- Accept only supported image MIME types and verify file signatures rather than trusting
Content-Typeor file extensions. - Do not upload a response unless retrieval, type validation, and size validation all succeed.
- Avoid exposing uploaded resources until publication is explicitly confirmed by the user.
- Log rejected destinations and retrieval failures without recording credentials, signed upload URLs, API keys, or sensitive response content.
- Permit only