T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:52- Finding
Unrestricted Server-Side Retrieval of User-Controlled URLs
- Content
View full analysis
" -o /tmp/temp_input.pdf python3 scripts/add_pdf_watermark.py /tmp/temp_input.pdf "<水印文字>" /tmp/output_watermarked.pdf ``` ### Technical Analysis The skill directs the agent to retrieve an arbitrary user-supplied URL using `curl -L`. It does not require validation of the URL scheme, hostname, resolved IP address, redirect targets, response size, content type, or file signature. Because redirects are followed automatically, validating only the initial URL would also be insufficient. An attacker-controlled public endpoint could redirect the request to a loopback, link-local, private-network, or cloud metadata address. Although the retrieved content is not executed as code, the request originates from the agent's environment and may therefore reach services unavailable to the requester. If an internal service returns a valid PDF, the skill can process that file and return its contents to the requester as a watermarked document. ### Attack Path 1. An attacker asks the agent to watermark a PDF at a crafted URL. 2. The URL directly targets an internal address or redirects to one. 3. Following the documented workflow, the agent invokes `curl -L`. 4. The request is issued from the agent's network context. 5. An internal or otherwise restricted resource responds. 6. If the response is a parseable PDF, the skill watermarks it and sends the resulting document to the attacker. 7. Even when the response is not a PDF, response behavior may permit internal service discovery or cause resource exhaustion. ### Impact Assessment A successful exploit can allow access to HTTP resources available from the agent's network environment, including loopback services, private-network applications, and potentially cloud metadata endpoints. The practic ...[truncated 334 chars]- Remediation
View remediation