security vulnerability_error ai_generated true

SSRF: server-side request to internal resource

ID: security/ssrf-vulnerability

Also available as: JSON · Markdown
82%Fix Rate
86%Confidence
3Evidence
2023-01-01First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
any active — — —

Root Cause

Application makes server-side request to attacker-specified URL.

generic

Workarounds

  1. 90% success Use allowlist of permitted domains/IPs for outgoing requests
  2. 92% success Block access to cloud metadata endpoints (169.254.169.254)

Dead Ends

Common approaches that don't work:

  1. Blocklist localhost and 127.0.0.1 only 82% fail

    Bypassed with DNS rebinding, IPv6, or decimal IPs

  2. Resolve DNS and check IP once 78% fail

    TOCTOU with DNS rebinding