Loading...
Loading...
Image proxy fetches user-provided URLs without validation.
1@app.route('/proxy-image')2def proxy_image():3 url = request.args.get('url')4 response = requests.get(url)5 return Response(response.content, mimetype='image/png')
The server fetches any URL the user provides. Attackers can use this to access internal services, scan internal networks, or retrieve cloud metadata credentials.
Attacker accesses internal services through the proxy
/proxy-image?url=http://localhost:8080/admin
/proxy-image?url=http://192.168.1.1/router-config✓ Server fetches internal URLs
✓ Attacker sees admin panel content
✓ Can access any internal service