T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- scripts/fetch_swagger.py:41
- Finding
- Unrestricted URL Fetching Enables Server-Side Request Forgery<![CDATA[ ## Vulnerability Details **File Location**: `scripts/fetch_swagger.py:41-44, 78-80` **Vulnerability Type**: Server-Side Request Forgery through unrestricted URL fetching **Risk Level**: High ### Vulnerable Code ```python request_url = url request = urllib.request.Request(request_url, method='GET') request.add_header('Accept', 'application/json') # Authentication handling omitted try: with urllib.request.urlopen(request, timeout=30) as response: data = response.read().decode('utf-8') return json.loads(data) ``` ### Technical Analysis The script passes a user-supplied URL directly to `urllib.request.urlopen()` without validating: - The URL scheme - The destination hostname or port - Resolved IP addresses - Loopback, link-local, private, or reserved address ranges - Redirect destinations - The number of redirects - Response size or expected content type Consequently, the process can be induced to send requests to resources accessible from its own network context. These may include loopback services, private network applications, container-management interfaces, or cloud instance metadata endpoints. The function parses a successful response as JSON, and the caller subsequently writes that data to stdout or a selected output file. Therefore, JSON-compatible internal responses can be returned to the user invoking the Skill. ### Attack Path 1. An attacker supplies a Swagger URL pointing to an internal service, local address, or attacker-controlled redirect. 2. The Agent invokes `fetch_swagger.py` with that URL as part of the Skill's documented workflow. 3. `urlopen()` resolves and accesses the destination using the Agent host's network privileges. 4. If the destination returns valid JSON, the script parses it successfully. 5. The parsed response is printed to stdout or saved to a file. 6. The attacker obtains data from a service that may not have been directly reachable from the attacker's own network position. ### Impact Ass ...[truncated 673 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Permit only `https://` URLs by default. 2. Parse the URL before opening it and reject unsupported schemes, embedded credentials, malformed hostnames, and unexpected ports. 3. Resolve all destination addresses and reject loopback, private, link-local, multicast, unspecified, and reserved ranges. 4. Disable automatic redirects or validate every redirect destination using the same scheme, hostname, port, and resolved-address rules. 5. Support an explicit hostname allowlist for controlled Agent deployments. 6. Limit response size before reading the entire body into memory. 7. Verify that the response has an expected JSON content type before processing it. 8. Reject URL fragments and normalize hostnames to prevent validation bypasses. 9. Consider requiring explicit user confirmation for destinations outside a configured API domain. ]]>