Insecure consumption of integrations
Calling out is as risky as being called. When a user-controlled value ends up in the URL, the path, the query string or the body of an outgoing request, your application becomes a proxy that an attacker can aim at systems they could never reach themselves.
How this shows up in a Mendix application.
Hostnames from editable attributes
The target of the call comes from data the user can change, instead of from a constant.
No URL encoding
Values are dropped into a URL or query string unencoded, which opens path traversal and parameter injection.
Bodies built by string concatenation
JSON or XML assembled by hand instead of through an export mapping, so structure and content blur together.
User-supplied webhook URLs
The application sends data wherever the user says, with no validation of the destination.
No authorisation before the call
The microflow calls the back end without checking whether this user may ask for this object, which is an insecure direct object reference by another name.
Redirects followed automatically
The client follows wherever the response points, including to somewhere the attacker chose.
What it lets someone do.
Every item below has been found in production applications. None of them requires a sophisticated attacker: they require somebody who reads the page source, edits a request or simply logs in.
How to keep it out.
Constants for hosts, encoding for values
Hostnames in constants, user-specific values not editable by the user, and urlEncode on everything placed in a URL.
Mappings, not string building
Export mappings for REST and SOAP bodies, so the structure of the request is modelled rather than typed.
Authorise, then call
An explicit check in the microflow before the request, and no raw HTTP responses or error text shown to the user.
What Omnext checks for you.
Omnext follows the data path into outgoing calls and flags user-controlled values in URLs, unencoded parameters, hand-built bodies and calls that run without an authorisation check.
The framework is The S-Unit's.
The S-Unit Top 10 is the work of The S-Unit, the Mendix security specialists. They built it from more than ten years of offensive security work and hundreds of Mendix penetration tests, and they maintain the canonical version. Omnext automates the checks in the Security Analysis module; the framework itself is theirs, and this page explains it in our own words.
Which of the ten are you sure about?
Ten questions, about four minutes, results on screen. Or let the scan answer all ten with evidence from your own model.