API · tessellatepay.com · criticality A
api.tessellatepay.com · secret API key in the Authorization header · 64 endpoints in its spec, 30 in scope
CVE-2024-34351 · confirmed by our own template · api.tessellatepay.com
Next.js 14.1.0: Server-Side Request Forgery in Server Actions. Proven on api.tessellatepay.com: our template made your server call out to us. An attacker can use the API server to reach internal services, including the AWS metadata endpoint that hands out credentials. A rescan started at 10:19 will say whether this morning's release fixed it.
What it is
The REST API merchants build on: charges, refunds, transfers, payouts.
On api.tessellatepay.com · 2 issues
Every route we know it answers on
65 URLs · 65 shapes · crawled, read from its scripts, seen in traffic, archived, in its spec
65 URLs · 65 shapes
↑ ↓ to move
What we test on the public API
OpenAPI · found at api.tessellatepay.com/openapi.json in the scan of Thu 1 Oct · 64 endpoints
We’ll test 0 of 64 endpoints, reads only: no POST, PUT, PATCH or DELETE.
Left out to start with: card endpoints are in your PCI scope, which your assessor tests under its own agreement.
POST /v1/keys/roll: left out to start with: rolling the key mid-scan would cut off your merchants' integrations.
Not in the spec
Web archives remember it and it still answers, but the spec doesn’t declare it, so it isn’t in the list above. Internal routes shouldn’t be on the internet: take it off, or put it behind the key.
Testing it the way a merchant's code calls it
64 routes we can see the door of, but not open · the engine’s next big step
With a test-mode key, we’d call every endpoint in scope the way a merchant’s code does, and check what each one lets that key see and do.
How it’s kept