T09 · Insecure Skill Coding Practices
Warning
- Location
index.js:4- Finding
Unrestricted URL Requests Enable Server-Side Request Forgery and Internal Network Probing
- Content
View full analysis
{ const protocol = url.startsWith('https') ? https : http; const req = protocol.request(url, { method: 'HEAD', timeout: 5000 }, (res) => { resolve({ url, valid: res.statusCode >= 200 && res.statusCode < 400, status: res.statusCode }); }); req.on('error', (err) => { resolve({ url, valid: false, error: err.message }); }); req.on('timeout', () => { req.destroy(); resolve({ url, valid: false, error: 'timeout' }); }); req.end(); }); } async function main() { const args = process.argv.slice(2); const urls = args.filter(arg => arg.startsWith('http')); ``` ### Technical Analysis The Skill performs network requests to user-controlled URLs without enforcing its documented restriction to external HTTP or HTTPS resources. The only input check is whether the string begins with `http`, which does not prevent requests to loopback, private, link-local, reserved, or internal network destinations. Consequently, inputs such as the following may be requested from the execution host: ```text http://127.0.0.1:8080/ http://localhost:3000/ http://10.0.0.1/ http://169.254.169.254/ http://[::1]/ ``` The application returns the HTTP status code or connection error for each target. These results can disclose whether internal hosts, ports, and services are reachable. DNS names are also unrestricted, so an attacker-controlled hostname could resolve to an internal address or potentially use DNS rebinding techniques. Using the `HEAD` method reduces response-body disclosure but does not eliminate the vulnerability. Status codes, errors, and response timing still pr ...[truncated 1664 chars]- Remediation
View remediation