Description
During the scan, Kayran managed to find the Potential to Server-Side Request Forgery (SSRF) vulnerability. SSRF attacks hold a range of risks, the attacker can supply or modify a given URL, which the code is running on the server to read or submit data. The attacker may be able to read server configurations such as cloud services metadata, etc.
SSRF can be exploited in order to gain access to internal servers found inside the network. To perform internal scan ports, and even to perform a Remote Code Execution (RCE). In addition, the attacker may cause the server to create a connection back to itself.
The attacker may also use this functionality to import unvalidated data into the code that expects to only read data from trusted sources, and as such bypass input validation.
Server-Side Request Forgery (SSRF) is an attack that can be used to make your application issue an arbitrary HTTP requests. SSRF is widely used by attackers to proxy requests from services exposed on the internet to un-exposed internal endpoints.
Recommendation
To prevent SSRF vulnerabilities in your web applications, the ideal situation is that your application does not need to make any arbitrary requests.
It is strongly advised to set and use a whitelist of allowed domains and protocols.
References
https://owasp.org/www-community/attacks/Server_Side_Request_Forgery
