CyberLucidCYBERLUCID

Server-Side Request Forgery (SSRF)

An attacker causes a server to make unintended outbound requests.

What it is

Server-side request forgery, or SSRF, makes a server send a request the user should not be able to cause. A server may reach internal services or privileged endpoints unavailable to the user's browser. The impact depends on reachable destinations, credentials, protocols, and whether responses are returned; not every SSRF results in full system access.

How it works

A feature fetches a supplied URL for a preview, import, image, or webhook. Weak checks allow an unintended address, a redirect to one, or a destination that resolves differently than expected. The request crosses a trust boundary using the server's network position and possibly its attached identity.

How people get tricked

The input looks like an ordinary resource URL. Developers validate its text once but overlook redirects, resolved addresses, or alternate request paths. No human has to open the target resource personally.

Example scenario

A document-preview service accepts a URL that redirects to an internal administration endpoint. The server, unlike the external user, has a network route to that endpoint.

Warning signs

  • URL-fetching services contact internal or unexpected destinations.
  • Outbound logs show unusual redirects or prohibited address ranges.
  • Fetch errors expose internal service details.

How to protect yourself

  • ✓ Allowlist required destinations and schemes and recheck redirects and resolved addresses.
  • ✓ Enforce outbound network restrictions independently of URL parsing.
  • ✓ Protect metadata and internal services with their own authentication controls.
  • ✓ Limit response exposure, credentials, time, and resource use for fetching features.

If it happens to you

Restrict the vulnerable fetch path and investigate reached endpoints and exposed responses. Revoke any credentials that may have escaped and assess internal actions. Test redirects and alternate resolution paths when validating the fix; a superficial prefix check is insufficient.

Know this now

The server may have more network access than the requester. A user-supplied URL must not inherit that privilege without controls.