Server-Side Request Forgery (SSRF)
Attacker tricks the server into making requests to internal resources — accessing cloud metadata, internal APIs, or services that should not be publicly reachable.
How It Works
SSRF occurs when a server-side application fetches a URL provided by the user without proper validation. The attacker can make the server request internal resources like cloud metadata endpoints (169.254.169.254), internal APIs, or databases that are only accessible from within the network. In cloud environments, the metadata endpoint can expose IAM credentials, leading to full account takeover.
app.post('/api/fetch-url', async (req, res) => {
const response = await fetch(req.body.url);
const data = await response.text();
res.json({ data });
});import { isAllowedUrl } from './url-validator';
app.post('/api/fetch-url', async (req, res) => {
if (!isAllowedUrl(req.body.url)) {
return res.status(400).json({ error: 'URL not allowed' });
}
const response = await fetch(req.body.url);
const data = await response.text();
res.json({ data });
});Real-World Example
The Capital One breach (2019) was caused by SSRF. An attacker exploited a misconfigured WAF to make requests to the AWS metadata endpoint, obtaining IAM credentials that gave access to S3 buckets containing 106 million customer records.
How to Prevent It
- Validate and whitelist allowed URLs and domains
- Block requests to internal IP ranges (10.x, 172.16.x, 192.168.x, 169.254.x)
- Use a URL parsing library to prevent bypass techniques
- Implement network-level controls to restrict outbound traffic
Affected Technologies
Data Hogo detects this vulnerability automatically.
Scan Your Repo FreeRelated Vulnerabilities
Broken Access Control
highUsers can act outside their intended permissions, accessing other users' data or admin functionality without proper authorization checks.
Cryptographic Failures
highSensitive data is exposed due to weak or missing encryption — using outdated algorithms like MD5/SHA1, storing passwords in plaintext, or transmitting data without TLS.
Supply Chain Failures
mediumYour application inherits vulnerabilities from third-party dependencies — outdated packages with known CVEs that attackers actively exploit.
Security Misconfiguration
mediumDefault configurations, open CORS policies, debug mode in production, or verbose error messages expose your application to attackers.