T09 · Insecure Skill Coding Practices
- Location
workflow.json:26- Finding
Unrestricted User-Controlled Scraping Target Enables SSRF
- Content
View full analysis
Vulnerability Details
File Location:
workflow.json:26-36
Vulnerability Type: Server-Side Request Forgery through an unrestricted scraping URL
Risk Level: HighVulnerable Code:
json "config": { "source_url": "User Input", "selectors": [ "h2.loop-card__title", "h2.post-block__title", "a.post-block__title__link", "h2.wp-block-post-title" ], "fallback": "Keyword fallback (ai / tech / startup / app / model)", "max_items": 3 }Technical Analysis
The workflow accepts the scraping destination directly from user input. It declares no URL scheme restriction, domain allowlist, DNS validation, redirect validation, or prohibition against loopback, link-local, private, and reserved network addresses.
If the workflow engine performs requests according to this configuration, an attacker who can provide the source URL can cause the runner to send requests from its own network context. This creates a server-side request forgery condition because the runner may have access to hosts or services that are inaccessible to the attacker.
The scraped response is also written to workflow output and supplied to the subsequent AI-generation step. Consequently, content obtained from an internal endpoint could be exposed in generated output or saved files, depending on how the workflow engine processes the response.
Attack Path
- An attacker starts the workflow and supplies a crafted source URL.
- The URL points to a loopback service, private-network host, link-local endpoint, or cloud metadata service.
- The workflow runner resolves and requests the supplied address from its trusted network environment.
- The scraping step extracts response text using its selectors or keyword fallback.
- Extracted content is stored in the raw output and passed to the AI-generation step.
- Internal response content may consequently appear in generated dra ...[truncated 686 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace unrestricted user input with an explicit allowlist of approved HTTPS origins, such as the intended technology-news domains.
- Parse URLs with a standards-compliant URL parser and permit only the
httpsscheme. - Resolve the hostname before connecting and reject loopback, link-local, private, multicast, unspecified, and reserved IP ranges for both IPv4 and IPv6.
- Repeat hostname and IP validation after every redirect, and impose a low redirect limit.
- Protect against DNS rebinding by connecting only to the validated resolved address while preserving the expected TLS hostname.
- Apply strict request timeouts, response-size limits, content-type restrictions, and outbound firewall rules.
- Prevent scraped internal or sensitive content from being copied automatically into generated drafts or persistent output.
- Record the validated destination and redirect chain in security logs without logging credentials or sensitive response bodies.