- Reads in a URL from a URL query param
- Without validating the URL, makes a request to it
- Validates the response - ensures that the response is a 200 and parses the JSON in a safe way, extracting the data it expects
- Uses the parsed data for some additional requests. Of course these additional requests fail unless the attacker-controlled server somehow serves valid information, which it should never have access to.
This seems like a vulnerable flow to me, though I haven't found a way to convincingly exploit the lack of URL validation. The specific attack scenario I was playing out is an attacker that set the arbitrary URL to point to a server they control, and sends that link to a legitimate user. Their server would have open CORS permissions and send back whatever data the attacker specifies.
The protections I have:
The request is a normal Ajax XMLHTTPRequest, which seems to prevent any control over the user's browser window such as open redirects or simply prompting the user to download malware.
If I'm performing proper validation on the JSON, is there a reason I need to validate the URL I'm pulling it from? Does allowing an attacker to specify an arbitrary GET request on a user's behalf through a benign-looking link constitute a security risk?