T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/video_snapper.py:246- Finding
Arbitrary Outbound Request Before Platform Validation Enables SSRF
- Content
View full analysis
str: try: resp = requests.head(url, allow_redirects=True, timeout=timeout) final_url = resp.url except: final_url = url parsed = urlparse(final_url) domain = parsed.netloc.lower() if any(d in domain for d in ['douyin.com', 'v.douyin', 'iesdouyin.com', 'tiktok.com']): return "抖音" elif any(d in domain for d in ['b23.tv', 'bilibili.com', 'bili']): return "B站" return "未知平台" ``` ### Technical Analysis The command-line URL is passed directly to `requests.head()` before the application validates its scheme, hostname, resolved IP address, or platform. The request also uses `allow_redirects=True`, so every redirect destination is contacted without validation. Consequently, a caller can cause the process to issue HTTP requests to destinations outside the declared Bilibili and Douyin scope, including: - Loopback services such as `127.0.0.1` or `::1` - RFC 1918 private-network addresses - Link-local services - Cloud instance metadata endpoints - An attacker-controlled URL that redirects to an internal service Although the response body is not returned directly, HTTP methods can still trigger side effects on poorly designed internal endpoints. Status-dependent timing and subsequent platform classification may also provide limited network-reachability information. ### Attack Path 1. An attacker supplies a URL pointing to an internal address, local service, or external redirector: ```text http://127.0.0.1:8080/internal-action ``` 2. `identify_platform_with_redirect()` invokes `requests.head()` before checking whether the destination belongs to an approved platform. 3. The Python process conn ...[truncated 811 chars]- Remediation
View remediation