Open Graph / link-preview SSRF

When it applies

The app unfurls user-supplied URLs — chat messages, comments, profile links, oEmbed consumers, "import bookmark", RSS/save-for-later. The dedicated fetch this triggers is an SSRF primitive, often with weaker filtering than the main app because previews must work for arbitrary third-party sites. Also applies when the preview is rendered by a headless browser (adds XSS-in-preview and local-file angles).

Why it works

Unfurlers are built to fetch anything, so allowlists are rare or trivially bypassed. The fetch frequently runs in a separate worker/microservice with its own network position — internal dashboards, metadata IPs, and queues may be reachable from there even when the web tier is locked down. The fetcher also parses the response (HTML, images, sometimes JS), which adds parser-differential bypasses the main app's URL validator doesn't share.