Description
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Potential Impact
- Confidentiality: Read Application Data
- Integrity: Execute Unauthorized Code or Commands
- Access Control: Bypass Protection Mechanism
Detection Methods
- Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin...
Related Weaknesses
References
View on MITRE CWE Database →
