T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- SKILL.md:52
- Finding
- Unrestricted Server-Side Retrieval of User-Controlled URLs<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 52-58 **Vulnerability Type**: Server-Side Request Forgery through unrestricted URL retrieval **Risk Level**: High ### Vulnerable Code ```bash curl -L "<PDF_URL>" -o /tmp/temp_input.pdf python3 scripts/add_pdf_watermark.py /tmp/temp_input.pdf "<水印文字>" /tmp/output_watermarked.pdf ``` ### Technical Analysis The skill directs the agent to retrieve an arbitrary user-supplied URL using `curl -L`. It does not require validation of the URL scheme, hostname, resolved IP address, redirect targets, response size, content type, or file signature. Because redirects are followed automatically, validating only the initial URL would also be insufficient. An attacker-controlled public endpoint could redirect the request to a loopback, link-local, private-network, or cloud metadata address. Although the retrieved content is not executed as code, the request originates from the agent's environment and may therefore reach services unavailable to the requester. If an internal service returns a valid PDF, the skill can process that file and return its contents to the requester as a watermarked document. ### Attack Path 1. An attacker asks the agent to watermark a PDF at a crafted URL. 2. The URL directly targets an internal address or redirects to one. 3. Following the documented workflow, the agent invokes `curl -L`. 4. The request is issued from the agent's network context. 5. An internal or otherwise restricted resource responds. 6. If the response is a parseable PDF, the skill watermarks it and sends the resulting document to the attacker. 7. Even when the response is not a PDF, response behavior may permit internal service discovery or cause resource exhaustion. ### Impact Assessment A successful exploit can allow access to HTTP resources available from the agent's network environment, including loopback services, private-network applications, and potentially cloud metadata endpoints. The practic ...[truncated 334 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Accept only HTTPS URLs unless an explicitly approved exception is required. - Parse and validate URLs before retrieval; reject embedded credentials and unexpected ports. - Resolve the destination hostname and reject loopback, link-local, private, multicast, reserved, and unspecified address ranges for both IPv4 and IPv6. - Repeat destination validation after every redirect, or disable redirects and process each redirect manually. - Prefer an explicit allowlist of trusted hosts when the operational use case permits it. - Apply strict connection, transfer, and total-operation timeouts. - Set a maximum response size and abort downloads that exceed it. - Verify the response content type and validate that the downloaded file begins with an expected PDF signature before processing. - Run network retrieval in a sandbox with no access to internal networks or cloud metadata services. - Do not return retrieved content to the requester unless authorization to access the source has been established. ]]>