Description

An API endpoint was found vulnerable to SSRF attacks. Server-Side Request Forgery (SSRF) is a web security vulnerability that allows an attacker to deceive the application and make requests to an unintended location.

In case the API does not properly prevent calling arbitrary web resources, attackers might steal sensitive information or perform unauthorized actions

Rationale

This finding works by identifying an API that contains code vulnerabilities permitting full or partial control of URLs used to fetch a remote resource.

Remediation

• Maintain a URL allowlist to validate the usage of trusted remote resources only