T09 · Insecure Skill Coding Practices
Error
- Location
- lib/torchsdk/tokens.js:272
- Finding
- Unrestricted On-Chain Metadata URL Fetch Enables Server-Side Request Forgery<![CDATA[ ## Vulnerability Details **File Location**: `lib/torchsdk/tokens.js:272-276`; supporting fetch implementation at `lib/torchsdk/gateway.js:30-41` **Vulnerability Type**: Server-Side Request Forgery (SSRF) **Risk Level**: High ### Vulnerable Code ```js // lib/torchsdk/tokens.js:272-276 const uri = (0, program_1.decodeString)(bondingCurve.uri); if (uri) { try { const res = await (0, gateway_1.fetchWithFallback)(uri); const data = (await res.json()); ``` The destination is subsequently fetched without an allowlist or network-address validation: ```js // lib/torchsdk/gateway.js:30-41 const fetchWithFallback = async (url, options, timeoutMs = 10000) => { const controller = new AbortController(); const timer = setTimeout(() => controller.abort(), timeoutMs); const opts = { ...options, signal: controller.signal }; try { // If it's an Irys gateway URL, use uploader directly (gateway has SSL issues) if ((0, exports.isIrysUrl)(url)) { const uploaderUrl = (0, exports.irysToUploader)(url); return await fetch(uploaderUrl, opts); } // For non-Irys URLs, fetch normally return await fetch(url, opts); ``` ### Technical Analysis The metadata URI is decoded from a token's on-chain bonding-curve account. A token creator can therefore control this value. Although the gateway helper specially handles Irys URLs, every other URI is passed directly to `fetch()`. The implementation does not: - Restrict the scheme to HTTPS. - Restrict requests to approved metadata gateways. - Reject loopback, link-local, private, multicast, or reserved IP ranges. - Resolve and validate DNS addresses before connecting. - Validate redirect destinations. - Restrict response size or verify that the response is JSON. The monitor invokes `getToken()` for discovered tokens with active loans. Consequently, this request can occur automatically during normal unattended operation rather than only in ...[truncated 1987 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Allow only `https:` metadata URLs. 2. Prefer an explicit hostname allowlist for trusted content-addressed gateways, such as approved Irys hosts. 3. Parse the URL before use and reject embedded credentials, malformed hosts, unexpected ports, and non-HTTP protocols. 4. Resolve the hostname before connecting and reject every address in loopback, link-local, private, multicast, unspecified, and reserved ranges for both IPv4 and IPv6. 5. Disable automatic redirects or validate the destination of every redirect using the same scheme, hostname, and resolved-address controls. 6. Defend against DNS rebinding by ensuring the validated address is the address used for the connection. 7. Limit response size, set strict connection and read timeouts, and require an appropriate JSON content type. 8. Consider retrieving metadata through a hardened proxy with no access to internal networks. 9. Treat token metadata as untrusted input and avoid fetching it in the automatic liquidation path unless it is operationally necessary. ]]>