T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/detect.py:123
- Finding
- Unrestricted Image URL Retrieval Enables Server-Side Request Forgery and Data Disclosure## Vulnerability Details **File Location**: `scripts/detect.py`, lines 123-128 **Vulnerability Type**: Server-Side Request Forgery (SSRF) and unintended data transmission **Risk Level**: Medium ### Vulnerable Code ```python if source.startswith(("http://", "https://")): requests = ensure_requests() try: resp = requests.get(source, timeout=30, headers={"User-Agent": "Mozilla/5.0"}) resp.raise_for_status() return base64.b64encode(resp.content).decode() except Exception as e: print(f"错误: 下载图片失败: {e}") sys.exit(1) ``` The returned content is later included in requests to the external ERiC service by image-based commands, including D001, L001, C001, and P001. ### Technical Analysis The image loader treats any user-supplied HTTP or HTTPS URL as a valid image source. It does not: - Restrict requests to HTTPS. - Resolve and reject loopback, private, link-local, reserved, or multicast addresses. - Revalidate destinations after HTTP redirects. - Verify that the response has an image content type. - Validate the downloaded file format. - Apply a maximum response-size limit. - Stream the response with a bounded read. Consequently, the process can be induced to request URLs that are accessible from the Agent's network environment but inaccessible to an external attacker. Potential destinations include localhost services, private-network systems, and cloud instance metadata endpoints. The fetched response is base64-encoded and, during normal execution of an image-based detection command, sent to the declared third-party API at `https://saas.eric-bot.com`. Base64 encoding itself is required by the documented API and is not covert behavior, but in combination with unrestricted URL retrieval it can transmit content obtained from unintended internal destinations. ### Attack Path 1. An attacker supplies, or causes an Agent to use, an internal URL as the image argument to `d001`, `l001`, `c001`, or `p001`. 2. `load_imag ...[truncated 1264 chars]
- Remediation
- ## Remediation Suggestions 1. Prefer local image files and disable URL retrieval unless it is essential. 2. If URLs must be supported, accept HTTPS only. 3. Parse and canonicalize the URL before use. 4. Resolve all destination addresses and reject: - Loopback ranges. - Private address ranges. - Link-local ranges. - Reserved and multicast ranges. - IPv4-mapped IPv6 representations of restricted addresses. 5. Disable redirects or manually follow them while repeating destination validation for every redirect. 6. Stream responses and enforce a strict maximum download size. 7. Require an approved image MIME type and validate file signatures after download. 8. Consider an explicit hostname allowlist. 9. Separate URL fetching from API submission and obtain explicit user confirmation before sending remotely retrieved content to a third party.