T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/search.py:90- Finding
Unrestricted Fetching of Search Result URLs Enables SSRF
- Content
View full analysis
Optional[str]: """Fetch a URL and extract clean readable text using trafilatura.""" try: downloaded = trafilatura.fetch_url(url, config=_traf_config) if not downloaded: return None return trafilatura.extract(downloaded, include_links=False, include_images=False, include_tables=True, deduplicate=True) or None except Exception: return None ``` Search-result URLs are submitted to this function concurrently: ```python for i, r in enumerate(results): if r.get("url"): futures[i] = pool.submit(_extract_content, r["url"]) ``` ### Technical Analysis The Skill downloads URLs supplied in Serper API responses without validating their scheme, hostname, resolved address, port, or redirect destination. Full-page retrieval is necessary for the declared content-extraction feature, but unrestricted destination access exceeds the minimum network privileges required. An attacker who can influence an indexed search result, compromise a result page, or otherwise affect the API response could provide a URL that directly or indirectly targets a service reachable from the machine running the Skill. The implementation contains no checks blocking loopback, private, link-local, reserved, multicast, or cloud metadata addresses. Redirects are also not revalidated by the Skill. The three-second downloader timeout limits request duration but does not prevent connection attempts or disclosure of quickly returned content. ### Attack Path 1. An attacker causes a malicious page to appear in results for a query likely to be submitted through the Skill. 2. Serper returns the attacker-controlled URL as an organic or news result. 3. The attacke ...[truncated 1059 chars]- Remediation
View remediation