T05 · Unauthorized Access and Privilege Escalation
Error
- Location
knowledge-base/SKILL.md:273- Finding
Unrestricted URL Retrieval Enables Server-Side Request Forgery and Data Exfiltration
- Content
View full analysis
` 查看响应头 - `application/pdf` → PDF 文件 - `application/msword` 或 `application/vnd.openxmlformats-*` → Word/PPT/Excel 文件 - `text/html` → 网页 3. **已知文件型 URL 模式**： - `arxiv.org/pdf/*` → PDF - `*.pdf`、`*.docx`、`*.pptx`、`*.xlsx` 结尾 → 对应文件类型 - GitHub raw 文件链接 → 按扩展名判断 # 1. 探测 URL 类型 CONTENT_TYPE=$(curl -sI -L "https://arxiv.org/pdf/2603.12268" | grep -i "^content-type:" | tail -1 | awk '{print $2}' | tr -d '\r') # 2. 下载文件到临时目录 TEMP_DIR=$(mktemp -d) # 根据 Content-Type 或 URL 推断文件名和扩展名 curl -sL -o "$TEMP_DIR/paper.pdf" "https://arxiv.org/pdf/2603.12268" ``` ### Technical Analysis The workflow instructs the Agent to issue HTTP requests to a supplied URL and follow redirects with `curl -L`. It does not impose an HTTPS-only policy, destination allowlist, port restriction, DNS/IP validation, redirect limit, or rejection of loopback, link-local, private, reserved, and cloud metadata address ranges. The separate rejection of local `file://` HTML content does not prevent network requests to destinations such as: - Loopback services such as `127.0.0.1` or `::1` - Private network services - Link-local services - Cloud instance metadata endpoints - Public URLs that redirect to one of these destinations - Hostnames affected by DNS rebinding The downloaded response is subsequently eligible for the normal upload flow, which sends it to Tencent COS and associates it with an IMA knowledge base. This turns the issue into both an internal request primitive and a possible data-exfiltration path. ### Attack Path 1. An attacker provides a URL presented as a downloadabl ...[truncated 1296 chars]- Remediation
View remediation