Fading Coder

The web aplication exposes a /read endpoint that accepts a url parameter and fetches its content using urllib.urlopen. Direct use of file:// is blocked by a regex that matches strings starting with file, but the scheme local_file:// bypasses this filter because the check uses ^file.* without conside...

Overview of Server-Side Request Forgery Server-Side Request Forgery (SSRF) is a security vulnerability where an attacker can induce a server-side application to make HTTP requests to an arbitrary domain of the attacker's choosing. This flaw typically arises when an application fetches a remote resou...