Information Disclosure :: Server Side Request Forgery


Problem Statement

The GraphQL mutation importPaste accepts arbitrary host, port and scheme to import pastes from and does not restrict input such as localhost or other internal servers from being used. This may allow forging requests on behalf of the application server to target other network nodes.

Resources
Exploitation Solution