TH17131
Detected presence of files containing domains used for intercepting and inspecting HTTP requests.
| priority | CI/CD status | severity | effort | RL level | RL assessment |
|---|---|---|---|---|---|
 | pass | high | high | None | None |
About the issue
Applications communicate with web services by exchanging HTTP requests. During software development, externally hosted services are used by developers to debug software quality issues relating to exchanging HTTP requests. Attackers commonly abuse tools designed for HTTP request inspection to monitor network traffic and extract sensitive information from the HTTP traffic. While the presence of domains related to HTTP inspection does not imply malicious intent, all of their uses in a software package should be documented and approved. Attackers might have purposely injected security testing tools in the software package to monitor the network traffic of the infected computer system. It is also possible that the software package has mistakenly included a part of its testing infrastructure during packaging.
How to resolve the issue
- Investigate reported detections.
- If the software should not include these network references, investigate your build and release environment for software supply chain compromise.
- You should delay the software release until the investigation is completed, or until the issue is risk accepted.
- Consider removing all references to flagged network locations.
Recommended reading
- HTTP guides (External resource - MDN web docs)