T09 · Insecure Skill Coding Practices
- Location
content.js:7- Finding
Unrestricted URL Fetching Enables Server-Side Request Forgery
- Content
View full analysis
Vulnerability Details
File Location:
content.js:7, 37-44
Additional Location:search.js:108-119
Vulnerability Type: Server-Side Request Forgery (SSRF) caused by unrestricted URL fetching
Risk Level: MediumVulnerable Code
content.jsaccepts a URL directly from the command line and passes it tofetchwithout validating its protocol, hostname, resolved IP address, port, or redirect destinations:js const url = process.argv[2]; try { const response = await fetch(url, { headers: { "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8", "Accept-Language": "en-US,en;q=0.9", }, signal: AbortSignal.timeout(15000), });search.jssimilarly fetches URLs obtained from search-result HTML without validating their destination:js async function fetchPageContent(url) { try { const response = await fetch(url, { headers: { "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8", }, signal: AbortSignal.timeout(10000), });Technical Analysis
Both request paths trust externally controlled URLs. The implementation does not:
- Restrict requests to
http:andhttps:. - Reject loopback, private, link-local, multicast, or reserved IP ranges.
- Resolve hostnames and inspect every resulting address.
- Restrict destination ports.
- Validate redirect destinations.
- Explicitly block cloud instance metadata endpoints.
Node.js
fetchfollows redirects by default. Consequently, validating only an initial URL would not be sufficient: an attacker-controlled public endpoint could redirect the request to a private address or metadata service. DNS rebinding may also bypass simplistic hostname-only checks.In
content.js, the attacker can ...[truncated 1813 chars]- Restrict requests to
- Remediation
View remediation
Remediation Suggestions
- Parse every destination with
new URL()and reject malformed URLs. - Permit only explicitly required protocols, normally
https:and, if necessary,http:. - Reject embedded credentials and unnecessary or dangerous destination ports.
- Resolve the hostname before connecting and reject all loopback, private, link-local, multicast, unspecified, and reserved IPv4 and IPv6 ranges.
- Explicitly block known metadata destinations, including
169.254.169.254and applicable IPv6 equivalents. - Disable automatic redirects with
redirect: "manual". If redirects are required, apply the complete validation process to every redirect target and enforce a low redirect limit. - Protect against DNS rebinding by ensuring that the validated address is the address used for the connection, or route requests through a hardened egress proxy that enforces destination policy.
- Apply the same validation to direct user URLs and URLs parsed from Brave search results.
- Prefer an allowlist of public domains when operational requirements permit it.
- Add response-body size limits in addition to the existing timeout to reduce resource-exhaustion risk.
- Run the Skill with restricted network egress so it cannot reach internal networks or metadata services.
- Add automated tests covering loopback addresses, RFC 1918 ranges, link-local addresses, IPv6 local ranges, alternative IP representations, DNS rebinding scenarios, and public-to-private redirects.
- Parse every destination with