Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

fetch_page web tool performs unrestricted server-side HTTP fetch of agent-supplied URLs (SSRF)

オープン
  • 何か問題がありますか？
#1,018 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

@SiyuanChenToDo がすでに取り組んでいます。

2026年10月19日 から。

  • #1020 @SiyuanChenToDo による — オープン

評価

難易度
4/5
見積もり時間
3〜5日
初心者へのやさしさ
45/100
issue の種類
バグ
明瞭さ
明確に書かれている
活発さ
活発
技術スタック
python
領域
backend, security

調査の方向性

Start in ms_agent/tools/jina_reader.py by reading _is_direct_http_allowed() and the direct fetch and redirect handling described in the issue; then trace how ms_agent/tools/search/websearch_tool.py exposes fetch_page. Identify how destination addresses and redirect targets are validated, and define completion by preventing requests to internal or metadata endpoints while preserving allowed public page fetches. The issue provides no reproduction steps or named tests, so first locate the relevant tests.

索引モデルが issue の本文から書いたものです。

説明

Affected version/commit: modelscope/ms-agent @ a56afcc73f0049ba822af9569fd413a2e90677eb (branch main)

Summary

The fetch_page tool exposed by WebSearchTool (ms_agent/tools/search/websearch_tool.py) takes an arbitrary url string argument directly from the LLM/agent tool-call and fetches it server-side with no restriction on destination host or IP range. The only validation performed, _is_direct_http_allowed() in ms_agent/tools/jina_reader.py, checks that the URL scheme is http/https and that netloc is non-empty - it does not block loopback, link-local, private, or cloud-metadata address ranges, and does not check redirect destinations. This allows the agent process to be used to reach internal network services and cloud instance-metadata endpoints, with the response body returned into the agent's conversation context.

Details

WebSearchTool._get_tools_inner() registers a fetch_page tool whose only parameter is a free-form url string, described as "Fetch and parse a single web page by URL." call_tool() routes fetch_page calls to fetch_page(**tool_args), which flows to _fetch_content_sync(url) -> self._content_fetcher.fetch(url) -> fetch_single_text_with_meta(url, config) in jina_reader.py. That function tries the external Jina Reader service first, then falls back to a direct in-process fetch via _fetch_direct_http_pair(), gated only by:

def _is_direct_http_allowed(url: str) -> bool:
    try:
        parsed = urlparse(url)
        if parsed.scheme not in ('http', 'https'):
            return False
        if not parsed.netloc:
            return False
        return True
    except Exception:
        return False

urlopen() is then called directly on the supplied URL from within the ms-agent process. There is no denylist/allowlist for 127.0.0.1, 169.254.169.254 (cloud metadata), RFC1918 ranges, link-local IPv6, or any other internal address, and no check on redirect targets a server could issue after the initial request is accepted. Because the url argument is model-controlled - chosen directly by the LLM in response to a user prompt, or indirectly steered by content encountered during web search/browsing (prompt injection from a fetched page) - this gives any content the agent processes a path to make the host perform arbitrary internal HTTP requests and have the response text returned into the agent's own context.

Steps To Reproduce

(available upon request)

Impact

Server-side request forgery from the agent host. An attacker who can influence the agent's tool-call arguments (directly as a user, or indirectly via content the agent reads during browsing/search, i.e. prompt injection) can cause the host running ms-agent to issue HTTP requests to internal-only services and cloud metadata endpoints and have the response content returned into the conversation, potentially leaking credentials/tokens or enabling further internal pivoting.

主要言語
Python
スター
4.4k
フォーク
532
平均マージ
18時間 26分
マージ済み PR（30日）
10

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

modelscope/ms-agent のほかの issue

modelscope/ms-agent の issue をすべて見る

似ている issue

Python の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。