T05 · Unauthorized Access and Privilege Escalation
Error
- Location
run.sh:14- Finding
Arbitrary URL Fetching Enables SSRF and Local Resource Access
- Content
View full analysis
"$TMP_FILE"; then echo "❌ URL 접근 실패: $URL" rm -f "$TMP_FILE" exit 1 fi ``` ### Technical Analysis The caller controls the complete value passed to `curl`. The script does not validate the URI scheme, destination hostname, resolved IP address, port, or redirect target. The `-L` option follows redirects without independently validating each destination. Depending on the protocols enabled in the installed `curl` build, the input may also use non-HTTP schemes such as `file://`. Consequently, the scraper can be used as a confused deputy to access resources available to the process but unavailable to the remote or untrusted caller. The legitimate scraping function requires outbound access to selected public HTTP or HTTPS pages. Access to local files, loopback services, private networks, link-local addresses, cloud metadata services, and arbitrary protocols exceeds that minimum privilege. ### Attack Path 1. An attacker or untrusted request causes the Agent to invoke the Skill with a crafted URL. 2. The URL directly identifies a local file, loopback service, private network endpoint, link-local metadata service, or a public page that redirects to one. 3. `curl -L` retrieves the resource without destination restrictions. 4. The response is read from the temporary file and emitted to standard output. 5. The attacker obtains information accessible with the Skill process's network position or operating-system account. Example destination classes include: ```text file:///path/to/readable/file http://127.0.0.1:PORT/intern ...[truncated 890 chars]- Remediation
View remediation