T09 · Insecure Skill Coding Practices
Warning
- Location
douyin.js:175- Finding
Server-Side Request Forgery Through Weak Douyin URL Validation
- Content
View full analysis
{ const parsedUrl = new URL(url); const client = parsedUrl.protocol === 'https:' ? https : http; const opts = { method: options.method || 'GET', headers: { ...HEADERS, ...options.headers } }; const req = client.request(url, opts, (res) => { ``` ### Technical Analysis The application attempts to determine whether the submitted URL belongs to Douyin by checking whether its complete string contains `douyin.com`. A substring test does not validate the parsed hostname. Consequently, an attacker can submit a URL whose path, query string, or user-information section contains `douyin.com` while the actual destination is another host. For example: ```text http://127.0.0.1:8080/douyin.com ``` This URL satisfies `shareUrl.includes('douyin.com')`, but its destination host is `127.0.0.1`. The `httpRequest` function permits both HTTP and HTTPS and does not reject loopback, private, link-local, or otherwise sensitive destinations. The unsafe fallback request is reached when the initial fixed-domain Douyin metadata request does not produce a valid video object. The response is processed internally rather than directly returned, which limits direct data extraction, but the request can still reach and interact with internal HTTP services. ### Attack Path 1. An attacker supplies a crafted share link containing the text `douyin.com` outside the hostname. 2. `parseShareUr ...[truncated 1156 chars]- Remediation
View remediation