T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/nuclei_analyzer.py:139
- Finding
- Unsanitized Nuclei Fields Allow Markdown Report Content Injection<![CDATA[ ## Vulnerability Details **File Location**: `scripts/nuclei_analyzer.py`, lines 139–181 **Vulnerability Type**: Unsanitized Markdown generation **Risk Level**: Medium ### Vulnerable Code ```python lines = [] lines.append(f'# Nuclei Scan Analysis Report') lines.append(f'') lines.append(f'**Target:** {target}') lines.append(f'**Analyzed:** {timestamp}') lines.append(f'**Total findings (post-filter):** {len(findings)}') lines.append(f'') lines.append(f'## Summary by Severity') lines.append(f'') lines.append(f'| Severity | Count |') lines.append(f'|----------|-------:|') total = 0 for sev in ['critical', 'high', 'medium', 'low', 'info']: if sev in groups: count = len(groups[sev]) total += count emoji = {'critical': '🔴', 'high': '🟠', 'medium': '🟡', 'low': '🟢', 'info': '⚪'}.get(sev, '⚪') lines.append(f'| {emoji} {sev.upper()} | {count} |') lines.append(f'| **TOTAL** | **{total}** |') lines.append(f'') # High+ detailed findings for sev in ['critical', 'high']: if sev not in groups: continue lines.append(f'## {sev.upper()} Severity Findings') lines.append(f'') for f in groups[sev]: lines.append(f'### {f["name"]}') lines.append(f'') lines.append(f'- **Template:** `{f["template"]}`') lines.append(f'- **URL:** {f.get("url", "unknown")}') if f.get('description'): lines.append(f'- **Description:** {f["description"]}') if f.get('matched_at'): lines.append(f'- **Matched at:** {f["matched_at"]}') # Attack scenario lines.append(f'') lines.append(f'**Attack Scenario:**') lines.append(f'An attacker could exploit this finding to {f["description"].lower() if f.get("description") else "impact the target"}.') lines.append(f'') ...[truncated 3158 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Treat every value parsed from Nuclei output as untrusted. 2. Implement contextual Markdown escaping for headings, prose, inline-code spans, and table cells. Escape or neutralize backslashes, backticks, asterisks, underscores, brackets, angle brackets, pipes, carriage returns, and newlines as appropriate for each context. 3. Reject or normalize embedded carriage returns and newlines when fields are expected to occupy a single report line. 4. Validate report URLs with a URL parser and permit only expected schemes such as `http` and `https`. Do not render arbitrary schemes as active links. 5. Escape raw HTML or configure the Markdown renderer to disable raw HTML. 6. Configure report-viewing environments to block automatic loading of remote images and other external resources. 7. Avoid constructing attack-scenario prose directly from an untrusted description. Render the description as escaped evidence instead. 8. Add regression tests covering injected headings, fenced code blocks, inline-code termination, Markdown links, image beacons, raw HTML, pipes, and multiline values. ]]>