Route performs network requests with user provided URLs
このページは日本語には対応しておりません。随時翻訳に取り組んでいます。
翻訳に関してご質問やご意見ございましたら、
お気軽にご連絡ください。
Description
An API endpoint was found vulnerable to SSRF attacks. Server-Side Request Forgery (SSRF) is a web security vulnerability that allows an attacker to deceive the application and make requests to an unintended location.
In case the API does not properly prevent calling arbitrary web resources, attackers might steal sensitive information or perform unauthorized actions
Rationale
This finding works by identifying an API that contains code vulnerabilities permitting full or partial control of URLs used to fetch a remote resource.
- Maintain a URL allowlist to validate the usage of trusted remote resources only
