T09 · Insecure Skill Coding Practices
Error
- Location
scripts/research_mode_control_commands.py:138- Finding
DNS Rebinding Can Bypass URL Fetch Restrictions and Enable SSRF
- Content
View full analysis
Vulnerability Details
File Location:
scripts/research_mode_control_commands.py:138-190
Vulnerability Type: Server-Side Request Forgery through DNS time-of-check/time-of-use inconsistency
Risk Level: HighVulnerable Code
python def _validate_fetchable_url(url: str) -> None: parsed = urlparse(url) if parsed.scheme not in {"http", "https"}: raise ValidationError( "attach-url-as-md only supports http:// and https:// URLs" ) host = (parsed.hostname or "").strip().rstrip(".") if not host: raise ValidationError("attach-url-as-md requires a URL host") lowered = host.lower() if lowered == "localhost" or lowered.endswith(".localhost"): raise ValidationError(f"Blocked local or private host in URL: {host}") try: ipaddress.ip_address(host) except ValueError: port = parsed.port or (443 if parsed.scheme == "https" else 80) try: resolved = socket.getaddrinfo(host, port, type=socket.SOCK_STREAM) except OSError as exc: raise ValidationError( f"Failed to resolve URL host: {host} ({exc})" ) from exc for item in resolved: sockaddr = item[4] ip_text = str(sockaddr[0]) if _is_blocked_url_ip(ip_text): raise ValidationError( f"Blocked local or private host in URL: {host}" ) else: if _is_blocked_url_ip(host): raise ValidationError( f"Blocked local or private host in URL: {host}" ) class _ValidatedRedirectHandler(urllib.request.HTTPRedirectHandler): def redirect_request(self, req, fp, code, msg, headers, newurl): _validate_fetchable_url(str(newurl)) return super().redirect_request(req, fp, code, msg, headers, newurl) def _fetch_url_as_m ...[truncated 3642 chars]- Remediation
View remediation
Remediation Suggestions
- Resolve each hostname once and retain only addresses that pass the network policy.
- Connect directly to a selected validated IP address rather than allowing the HTTP library to resolve the hostname again.
- Preserve the original hostname for the HTTP
Hostheader and TLS Server Name Indication while connecting to the validated IP. - Verify the connected socket's peer address before transmitting or accepting response data. Reject any peer that differs from the approved address set.
- Repeat the resolve, validate, connect, and peer-verification procedure for every redirect.
- Disable environment-derived proxies unless explicitly trusted. A proxy can otherwise change the effective network path and invalidate assumptions made by local DNS checks.
- Enforce network-level egress restrictions that block loopback, private, link-local, multicast, reserved, and cloud metadata ranges. Application validation should not be the sole SSRF control.
- Add regression tests using a connector whose validation lookup and connection lookup return different addresses. The test should prove that no request reaches the internal fixture.
- Apply response byte limits while streaming instead of reading the complete body before applying
max_chars. - Consider an explicit destination-host allowlist for automated or unattended research tasks.