# Insertion of Sensitive Information Into Sent Data (CWE-201)

The product sends data to another actor, but this data contains sensitive information that should not be accessible to that actor.

**Stack:** JavaScript

- Prevalence: Medium 3 languages covered
- Impact: Critical 3 critical-severity rules
- Prevention: Documented 3 fix examples

**OWASP:** Broken Access Control (A01:2021-Broken Access Control) - #1

## Description

An attacker may be able to intercept or receive data that contains sensitive information, such as credentials, tokens, or internal system details, that were not intended for them.

## Prevention

Prevention strategies for Insertion of Sensitive Information based on 1 Shoulder detection rules.

### JavaScript

Validate webhook URLs against a domain allowlist and never send internal credentials

## Warning Signs

- [CRITICAL] when internal credentials (API keys, secrets, tokens) are sent in HTTP requests
to user-controlled e

## Consequences

- Read Application Data
- Gain Privileges

## Mitigations

- Review all data being sent to external actors for sensitive information
- Implement data classification and ensure sensitive data is properly protected
- Use secure channels for transmitting sensitive information

## Detection

- Total rules: 3
- Critical: 3
- Languages: go, javascript, typescript, python

## Rules by Language

### Javascript (1 rules)

- **Credential Exfiltration via User-Controlled Endpoint** [CRITICAL]: Detects when internal credentials (API keys, secrets, tokens) are sent in HTTP requests
to user-controlled endpoints. This allows attackers to exfiltrate server credentials
by providing a malicious webhook URL that captures the sensitive headers or body data.

Example vulnerable pattern:
```javascript
// User controls 'endpoint' from request
const endpoint = req.body.webhookUrl;

// Server sends its internal API key to attacker-controlled URL
await fetch(endpoint, {
  headers: { 'X-API-Key': process.env.INTERNAL_API_KEY }
});
```

This is different from standard SSRF (which accesses internal resources) - here the attacker
exfiltrates server credentials to their own controlled endpoint.
  - Remediation: 1. Never send internal credentials to user-controlled endpoints
2. Validate webhook URLs against a strict allowlist of trusted domains
3. Use webhook secrets for authentication instead of sending API keys

```javascript
// SAFE: Validate webhook URL against allowlist
const ALLOWED_WEBHOOK_DOMAINS = ['api.slack.com', 'hooks.stripe.com'];

const webhookUrl = new URL(req.body.webhookUrl);
if (!ALLOWED_WEBHOOK_DOMAINS.includes(webhookUrl.hostname)) {
  return res.status(400).json({ error: 'Untrusted webhook domain' });
}

// SAFE: Use webhook-specific secret, not internal API key
await fetch(webhookUrl, {
  headers: { 'X-Webhook-Secret': req.body.webhookSecret }
});
```

Learn more: https://shoulder.dev/learn/javascript/cwe-201/credential-exfiltration

### Typescript (1 rules)

- **Credential Exfiltration via User-Controlled Endpoint** [CRITICAL]: Detects when internal credentials (API keys, secrets, tokens) are sent in HTTP requests
to user-controlled endpoints. This allows attackers to exfiltrate server credentials
by providing a malicious webhook URL that captures the sensitive headers or body data.

Example vulnerable pattern:
```javascript
// User controls 'endpoint' from request
const endpoint = req.body.webhookUrl;

// Server sends its internal API key to attacker-controlled URL
await fetch(endpoint, {
  headers: { 'X-API-Key': process.env.INTERNAL_API_KEY }
});
```

This is different from standard SSRF (which accesses internal resources) - here the attacker
exfiltrates server credentials to their own controlled endpoint.
  - Remediation: 1. Never send internal credentials to user-controlled endpoints
2. Validate webhook URLs against a strict allowlist of trusted domains
3. Use webhook secrets for authentication instead of sending API keys

```javascript
// SAFE: Validate webhook URL against allowlist
const ALLOWED_WEBHOOK_DOMAINS = ['api.slack.com', 'hooks.stripe.com'];

const webhookUrl = new URL(req.body.webhookUrl);
if (!ALLOWED_WEBHOOK_DOMAINS.includes(webhookUrl.hostname)) {
  return res.status(400).json({ error: 'Untrusted webhook domain' });
}

// SAFE: Use webhook-specific secret, not internal API key
await fetch(webhookUrl, {
  headers: { 'X-Webhook-Secret': req.body.webhookSecret }
});
```

Learn more: https://shoulder.dev/learn/javascript/cwe-201/credential-exfiltration