Route performs network requests with user provided URLs

이 페이지는 아직 영어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Description

An API endpoint was found vulnerable to SSRF attacks. Server-Side Request Forgery (SSRF) is a web security vulnerability that allows an attacker to deceive the application and make requests to an unintended location.

In case the API does not properly prevent calling arbitrary web resources, attackers might steal sensitive information or perform unauthorized actions

Rationale

This finding works by identifying an API that contains code vulnerabilities permitting full or partial control of URLs used to fetch a remote resource.

Remediation

  • Maintain a URL allowlist to validate the usage of trusted remote resources only