Server-Side Request Forgery (SSRF)
SSRF allows attackers to induce the server to make HTTP requests to an arbitrary domain of the attacker's choosing. This can be used to access internal services, cloud metadata endpoints, and bypass firewalls.
Overview
Server-Side Request Forgery (SSRF) is a vulnerability that abuses server functionality to access or modify resources. The attacker can force the server to make requests to internal services, cloud provider metadata endpoints (169.254.169.254), or arbitrary external servers. In cloud environments, SSRF can lead to credential theft through metadata services.
Types & Variants
Basic SSRF
Server fetches a URL provided by the attacker, returning the response content.
Blind SSRF
The server makes the request but the response is not returned. Exploitation confirmed through timing or out-of-band channels.
SSRF to Cloud Metadata
Accessing cloud provider metadata services to steal IAM credentials.
Impact
Access to internal services, cloud metadata theft (AWS credentials), port scanning of internal networks, and bypass of access controls.
Examples
AWS Metadata Theft
GET /fetch?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/
Remediation
Validate and sanitize all user-supplied URLs, implement allowlists for outbound requests, block requests to private IP ranges and cloud metadata endpoints, and disable unnecessary URL schemes.
Validate and sanitize all user-provided URLs
Use allowlists for permitted domains and protocols
Block requests to private IP ranges (10.x, 172.16.x, 192.168.x)
Block cloud metadata endpoints (169.254.169.254)
Disable unnecessary URL schemes (file://, gopher://)
Use network-level controls to restrict outbound requests
Related SuperClue scanner checks
These scanner checks look for signs of Server-Side Request Forgery (SSRF). What a scan can confirm from outside depends on your application.
Scan a domain you have verified with up to 350 modules, paid in credits.
See how website scanning works