T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/ares_client.py:440
- Finding
- Unrestricted API Base URL Enables SSRF-Like Outbound Requests## Vulnerability Details **File Location**: `scripts/ares_client.py`, lines 272–273, 346–347, 353–367, and 440 **Vulnerability Type**: Unrestricted network destination / server-side request forgery **Risk Level**: Medium The client exposes an undocumented `--base` command-line option whose value is used directly to construct outbound request URLs. The code does not require HTTPS, restrict the destination to `ares.gov.cz`, reject private or loopback addresses, or validate redirect destinations. ```python def fetch_pravni_forma_from_ares(base: str) -> dict[int, str]: url = f"{base.rstrip('/')}/ciselniky-nazevniky/vyhledat" payload = http_json("POST", url, payload={"kodCiselniku": "PravniForma"}) mapping: dict[int, str] = {} extract_codelist_pairs(payload, mapping) if mapping: return mapping raise AresError("Failed to decode codelist PravniForma", status=200, details={"url": url}) ``` ```python def fetch_ico(base: str, ico: str) -> dict[str, Any]: return http_json("GET", f"{base.rstrip('/')}/ekonomicke-subjekty/{ico}") ``` ```python def fetch_search( base: str, name: str | None, city: str | None, nace: list[str] | None, limit: int, offset: int, ) -> dict[str, Any]: body: dict[str, Any] = { "pocet": limit, "start": offset, "razeni": [DEFAULT_SORT], } if name: body["obchodniJmeno"] = name if city: body["sidlo"] = {"nazevObce": city} if nace: body["czNace"] = nace if not name and not nace: raise ValidationError("search requires at least --name or --nace") return http_json("POST", f"{base.rstrip('/')}/ekonomicke-subjekty/vyhledat", payload=body) ``` ```python parser.add_argument("--base", default=DEFAULT_BASE, help=f"ARES base URL (default: {DEFAULT_BASE})") ``` ### Technical Analysis User-controlled `args.base` reaches the URL ...[truncated 2716 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the `--base` option from production-facing commands if custom endpoints are not a genuine operational requirement. 2. If endpoint configurability is required, parse the URL with `urllib.parse.urlsplit` and enforce all of the following: - The scheme must be `https`. - The hostname must exactly equal `ares.gov.cz`. - Embedded user information must be rejected. - Unexpected ports must be rejected. - URL fragments and ambiguous malformed URLs must be rejected. 3. Disable automatic redirects or implement a redirect handler that validates every redirect destination against the same scheme, hostname, and port allowlist. 4. Perform validation immediately before each network request so no alternative call path can bypass it. 5. If non-production endpoints are necessary for tests, expose them only through a clearly gated development mechanism, such as a test-only dependency injection interface, rather than a general command-line option. 6. Add automated negative tests covering HTTP URLs, loopback addresses, private-network addresses, embedded credentials, alternate ports, hostname confusion, and redirects to prohibited destinations. 7. Document the permitted outbound destination and ensure deployment-level egress controls independently restrict this Skill to the official ARES host.