Host · tessellatepay.com · Sandbox · criticality B
401 · Unauthorized · Cape Town · AWS af-south-1 · 2 open issues · first seen 2 Sep · last scanned Mon 12 Oct · scanning now, since 10:19
two serious issues open · public exploit
Next.js 14.1.0: Server-Side Request Forgery in Server Actions and no HSTS. Proven on api.tessellatepay.com: our template made your server call out to us. An attacker can use the API server to reach internal services, including the AWS metadata endpoint that hands out credentials.
What to fix on it first
2 issues · ranked by proof, then exploitation in the wild, then severity
Exploit code is public · 1
Everything else, worst first · 1
Who gets its findings, and how much it matters
Owner routes findings · criticality moves them up the queue
What it's for
Where developers try the API
Criticality
Feeds the crown jewels, or holds staff and partner data
What answers, from where, running what
As the last finished scan saw it
On the web
How it meets the internet
Straight onto the internet
Its own address answers. Whatever it runs, attackers reach directly.
Runs
What it offers anyone who asks
Open ports, the headers its pages send, the routes we know
Ports
Headers