T09 · Insecure Skill Coding Practices
- Location
scripts/music.py:174- Finding
Unrestricted Network Download and Arbitrary File Overwrite
- Content
View full analysis
Vulnerability Details
File Location:
scripts/music.py, lines 174-182
Vulnerability Type: Server-Side Request Forgery (SSRF), unbounded download, and arbitrary file overwrite
Risk Level: Highpython response = requests.get(music_url, timeout=300, stream=True) response.raise_for_status() with open(output_path, "wb") as f: for chunk in response.iter_content(chunk_size=8192): f.write(chunk) return output_pathThe vulnerable parameters are exposed directly through the command-line interface:
python dl_parser.add_argument("url", help="音乐URL") dl_parser.add_argument("-o", "--output", required=True, help="保存路径") # ... elif args.command == "download": output_path = download_music(args.url, args.output) print(f"Music saved to: {output_path}")Technical Analysis
The
download_music()function accepts a caller-controlled URL and passes it directly torequests.get()without validating its scheme, hostname, resolved IP address, port, or redirect destination. A caller can consequently direct the process to HTTP or HTTPS services available from the skill's execution environment, including localhost, private network services, and cloud metadata endpoints.Requests follows HTTP redirects by default. Therefore, checking only an initial URL in a future calling layer would be insufficient: an allowed public endpoint could redirect the request to a private or otherwise prohibited destination.
The response is streamed directly to a caller-selected
output_path. The path is not restricted to a dedicated output directory, normalized and checked for containment, or protected against symbolic-link traversal. Opening it with mode"wb"creates the file if absent and truncates it if present. Any file writable by the process can therefore be replaced with attacker-selected response content.No maximum response size is enforced. The request timeout does not impose a total ...[truncated 1935 chars]
- Remediation
View remediation
Remediation Suggestions
-
Allowlist download origins
- Permit only HTTPS URLs.
- Restrict hosts to documented MiniMax download domains or another explicit CDN allowlist.
- Reject embedded credentials, unexpected ports, malformed hostnames, and non-HTTP schemes.
-
Prevent private-network access
- Resolve the hostname before connecting.
- Reject loopback, private, link-local, multicast, reserved, and unspecified IPv4 and IPv6 addresses.
- Account for all returned DNS records and DNS rebinding.
- Apply equivalent outbound restrictions at the firewall or container level.
-
Control redirects
- Disable automatic redirects with
allow_redirects=False, or validate the scheme, hostname, port, and resolved addresses of every redirect target before following it. - Enforce a small redirect limit.
- Disable automatic redirects with
-
Restrict output paths
- Write only beneath a dedicated output directory.
- Resolve the requested path and verify that it remains inside that directory.
- Generate server-controlled filenames where possible.
- Reject absolute paths, parent-directory traversal, symbolic links, and special files.
- Avoid overwriting existing files unless explicitly required and safely authorized.
-
Use safe file creation
- Create files with restrictive permissions.
- Use exclusive creation or a secure temporary file followed by an atomic rename.
- Validate the final destination again immediately before committing the file.
-
Limit downloaded content
- Set a maximum permitted byte count and abort once exceeded.
- Validate
Content-Lengthwhen present, while still enforcing a streaming byte counter. - Verify the expected content type and validate that the downloaded data is a supported audio format.
-
Reduce privileges
- Run the skill under a dedicated low-privilege account.
- Limit outbound network access and filesystem write permission ...[truncated 43 chars]
-