Description

An API endpoint forwards POST data across redirections from external APIs. When an application follows an HTTP redirect and resends the original POST body to the new destination, sensitive data such as credentials, tokens, or personally identifiable information may be unintentionally leaked to an untrusted third party. This behavior may happen when the server returns a 307 or 308 status code.

Rationale

This finding works by identifying an API route that accepts 307 or 308 redirections from a third party API call.

Remediation

• Configure HTTP clients to not forward POST bodies across redirections
• Implement explicit redirect handling that validates the target and strips sensitive data before following
• Ensure that sensitive data is only sent to explicitly trusted endpoints

References