T05 · Unauthorized Access and Privilege Escalation
Error
- Location
fetch.js:128- Finding
Unrestricted URL Fetching Enables Server-Side Request Forgery
- Content
View full analysis
{ if (url.startsWith("https://")) return url if (url.startsWith("http://")) return `https://${url.slice(7)}` fail("URL must start with http:// or https://") } async function grab(url) { const sig = AbortSignal.timeout(timeout) const init = { signal: sig, headers: hdrs("Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36"), } const first = await fetch(url, init).catch((err) => ({ err })) if (first && "err" in first) throw first.err if (first.status === 403 && first.headers.get("cf-mitigated") === "challenge") { return fetch(url, { signal: sig, headers: hdrs("opencode") }) } return first } async function main() { const src = norm(url0) const tried = [] let res let url = src for (const next of [src, url0]) { if (tried.includes(next)) continue tried.push(next) try { res = await grab(next) url = next break } catch (err) { if (next === url0) { fail(err instanceof Error ? err.message : String(err)) } } } ``` ### Technical Analysis The URL validation only verifies that the supplied value begins with `http://` or `https://`. It does not restrict the hostname, resolved IP address, port, or redirect destination. Consequently, the process can issue requests to loopback interfaces, private network ranges, link-local services, IPv6-local addresses, and cloud instance metadata endpoints. Node.js `fetch` also follows HTTP redirects by default, so validating only the initial URL would remain insufficient: a public URL can redirect to a prohibited internal destination. The HTTPS-first behavior does not prevent exploitation. If the supplied URL begins with HTTP, the program fi ...[truncated 1432 chars]- Remediation
View remediation