Out-of-band resource load (HTTP)
Summary: PortSwigger describes out-of-band resource load as a condition where an application can be induced to fetch content from an arbitrary external location and fold it into its own responses. The write-up notes this is not a vulnerability by itself and may be intended behavior, but can let the application server act as a two-way attack proxy against public third-party systems, internal systems, or services on its own loopback adapter.
Bottom line: An application that fetches arbitrary URLs can be turned against internal services that external attackers cannot otherwise reach, and content it retrieves from an attacker-controlled server is processed as input. PortSwigger's recommended controls are a URL whitelist, blocking the application server's network access to internal systems, and removing services on the loopback adapter.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026