T09 · Insecure Skill Coding Practices
Warning
- Location
huggingface_fetcher.py:96- Finding
Unrestricted Outbound Request Enables Server-Side Request Forgery
- Content
View full analysis
Dict: """ Get detailed information for a paper. Args: paper_url: Paper URL Returns: Paper details """ try: response = requests.get(paper_url, headers=self.headers, timeout=10) response.raise_for_status() soup = BeautifulSoup(response.text, 'html.parser') return { 'url': paper_url, 'fetched_at': datetime.now().strftime('%Y-%m-%d %H:%M:%S') } except Exception as e: logger.error(f"Failed to fetch paper details: {str(e)}") return {} ``` ### Technical Analysis The `fetch_paper_details()` method passes the caller-supplied `paper_url` directly to `requests.get()` without validating its scheme, hostname, resolved IP address, port, or redirect destination. Consequently, a caller can direct the Skill process to make HTTP requests to arbitrary destinations accessible from the host, including: - Loopback services such as `127.0.0.1` - Private network addresses - Link-local services and cloud metadata endpoints - Internal administrative interfaces - External URLs that redirect to prohibited internal destinations The configured timeout limits request duration but does not prevent SSRF. The Requests library also follows redirects by default, so validating only the initial URL would not be sufficient. This method is not invoked by the current `main.py` entrypoint. Exploitation therefore requires another integration, Agent tool binding, or future code path to expose this method while allowing an attacker to influence `paper_url`. Under that condition, the flaw provides blind SSRF behavior. Although the method does not return the response body, status, timing, success versus failure, and logged ...[truncated 1636 chars]- Remediation
View remediation