Demo: exploiting and fixing mass assignment and SSRF
On This Lesson 3 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
exploit and fix two flaws locally. Prepares JNR-041-LAB1.
Draft outline details
Step by step
- On the vulnerable branch, register with
"role":"ADMIN"in the body and become an admin. - Fix with a
RegisterRequestDTO; the extra field is now ignored. - Call the "import product image from URL" feature with an internal address; see data returned.
- Planned mistake: a deny-list for
localhostis bypassed with127.0.0.1or a redirect. Fix: an allow-list of hosts and resolved-address checks. - Add one regression test for each fix.
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.