Server-Side Request Forgery (SSRF)

What Is Broken and Why

SSRF occurs when an application fetches a remote resource based on user-supplied input without adequate validation. The server makes the request on behalf of the attacker, bypassing network perimeter controls that would block the attacker's direct access. Common targets include internal admin panels (accessible only from localhost), cloud metadata services (AWS/GCP/Azure instance metadata), internal databases and APIs, and arbitrary files on the server filesystem via the file:// scheme.

Key Signals

• Parameters named url, uri, path, redirect, link, src, href, fetch, load, resource, page, feed, callback, proxy
• Application fetches external content on behalf of the user (URL previews, webhooks, file imports, image fetching)
• PDF/report generators that render HTML (often process <img>, <iframe>, <link> tags server-side)
• Webhook configurations accepting attacker-controlled URLs
• Import features (RSS feeds, remote files, API integrations)
• Blind SSRF: no visible response but out-of-band DNS/HTTP callbacks observed