Unauthenticated route processes payments

이 페이지는 아직 영어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Description

Unauthenticated users have access to an API that’s processing payments. Attackers can abuse this endpoint to perform unauthorized actions, carding, or commit fraudulent activities.

Rationale

This finding works by identifying an API that is tracking a payment business logic event (tags containing the payment. prefix) but lacks an authentication mechanism.

Remediation

  • Implement authentication to prevent non-intended users interaction with the API