40046—Server Side Request Forgery

PUBLISHEDsecurity alertHigh

Active

Metadata

Alert ID:: 40046
Risk:: High
Type:: Active
CWE:: CWE-918Server-Side Request Forgery (SSRF)

摘要

The web server receives a remote address and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

解决方案

Do not accept remote addresses as request parameters, and if you must, ensure that they are validated against an allow-list of expected values.

其他信息

The canary token from the out-of-band service was found in the response body.

参考

browse all alerts