medium10 pts · first answer countssecurityowasp

Risk of "import image from URL"

Your API lets users import a profile picture by giving a URL, which the server downloads. An attacker submits http://169.254.169.254/latest/meta-data/. What vulnerability is this?

A.Cross-site scripting (XSS), because the downloaded image could carry a script that runs in other users' browsersB.Server-side request forgery (SSRF), which can reach internal services and cloud credentialsC.SQL injectionD.Clickjacking

← Benefit of INCLUDE in an index Any user can read any invoice →