T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/verify_links.py:27- Finding
Unrestricted URL Validation Enables Blind Server-Side Request Forgery
- Content
View full analysis
Tuple[bool, str]: """Check whether a URL returns HTTP 200.""" try: result = subprocess.run( ["curl", "-s", "-o", "/dev/null", "-w", "%{http_code}", url, "--connect-timeout", str(timeout)], capture_output=True, text=True, timeout=timeout + 2 ) code = result.stdout.strip() return (code == "200", code) except Exception as e: return (False, str(e)[:50]) ``` The URL passed to this function originates directly from workbook hyperlinks: ```python if cell.hyperlink: links.append({ "cell": cell.coordinate, "text": cell.value, "url": cell.hyperlink.target, "sheet": sheet_name }) ``` It is subsequently requested without validation: ```python url = link["url"] cell_ref = f"{sheet_name}!{link['cell']}" is_valid, code = check_url_http(url) ``` ### Technical Analysis The script treats hyperlink targets extracted from an input Excel workbook as trusted network destinations. It does not restrict URL schemes, destination hostnames, ports, resolved IP addresses, or redirect targets before passing each value to `curl`. Using an argument list for `subprocess.run` prevents ordinary shell metacharacter injection because no shell is invoked. However, it does not prevent server-side request forgery. An attacker-controlled workbook can contain hyperlinks that point to: - Loopback services such as `http://127.0.0.1/` - Private network services such as `http://10.0.0.1/` - Link-local or cloud metadata services - Int ...[truncated 1655 chars]- Remediation
View remediation