Web Security & VulnHawk Mastery

Server Misconfiguration, SSRF, Uploads and Dependencies

35 min

Misconfiguration

  • Debug mode off in production (Flask/Werkzeug's debugger allows code execution).
  • No default credentials; no admin panels exposed without protection.
  • Security headers: Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options: nosniff, Referrer-Policy, Permissions-Policy.
  • Directory listing off; error pages without stack traces.
  • Secrets in environment variables, never in Git; scan history for leaks.
  • CORS restricted to specific origins.

Server-side request forgery (SSRF)

If your app fetches URLs supplied by users (link previews, webhooks, image imports), an attacker can make your server request internal addresses: http://127.0.0.1:6379, cloud metadata endpoints like http://169.254.169.254/ (which can expose credentials), or private network services.

Defences:

  • Allowlist domains where possible.
  • Resolve the hostname and reject private, loopback and link-local IP ranges, after redirects too.
  • Disable redirects or re-validate each hop; set short timeouts and response size limits.
  • Run fetchers with no access to internal networks where possible.

File uploads

  • Limit size (MAX_CONTENT_LENGTH) and allowed types; verify content, not just the extension.
  • Store outside the web root with random names; serve through a permission-checked route with Content-Disposition: attachment for downloads.
  • Never execute or include uploaded files; strip image metadata if privacy matters.
  • Protect against path traversal: never join user-supplied paths without normalising and checking they stay inside the upload directory.

Vulnerable dependencies

Most code in your app comes from libraries. Keep them patched:

pip install pip-audit && pip-audit
npm audit

Enable Dependabot or Renovate for automatic update pull requests, and pin versions in lock files.

Exercise

Audit a Flask app for misconfiguration (debug, headers, cookies, CORS), add an SSRF-safe URL fetcher that rejects private IP ranges, harden file uploads against path traversal, and run pip-audit in CI.

Check yourself

  • Why is the cloud metadata address a common SSRF target?
  • How do you prevent path traversal in downloads?
  • How do you keep dependencies patched?

Seu progresso fica salvo apenas neste navegador.

Enviar para revisão (10 pontos)