Financial InstitutionWebAPI
Statement download path traversal
A statement filename with ../ escapes the directory and reads arbitrary server files.
- Attack
- Download ?file=../../../../etc/passwd.
- Nemesis defense
- Path-traversal patterns are blocked at the edge and in-app.
- Modelled on
- Legacy file-download endpoints across the sector.
Request — review or edit the fields, then run it
Request that will be sent
GET /api/statement?file=..%2F..%2F..%2F..%2Fetc%2Fpasswd