Server-Side Request Forgery (SSRF)
| Property | |
|---|---|
| Language |  |
| Severity |  |
| CWE | CWE-918: Server-Side Request Forgery (SSRF) |
| OWASP | A10:2021 - Server-Side Request Forgery (SSRF) |
| Confidence Level | Low |
| Impact Level | High |
| Likelihood Level | Low |
Description#
User-controlled input is being passed directly into the Dispatch url function, allowing attackers to specify arbitrary URLs for server-side requests. This makes it possible for untrusted users to control where the server sends HTTP requests.
Impact#
An attacker could use this to make your server access internal services or external malicious sites, potentially exposing sensitive data or enabling further attacks on internal infrastructure. They could also exfiltrate data or probe your network, leading to data breaches or service disruptions.