Server-side request forgery (SSRF) tricks your server into making HTTP requests on the attacker's behalf. Because the request comes from inside your network, it can reach systems the attacker cannot reach directly.

In cloud environments SSRF is especially dangerous: the cloud metadata service can hand out temporary credentials to whoever asks from inside the instance.

How it happens

Features that fetch a URL, such as link previews, webhooks, PDF generators, image importers and "import from URL", take an address from the user. If the server does not restrict where it may connect, an attacker can point it at internal admin panels, databases, or the cloud metadata endpoint.

Blind SSRF gives no response back, but the attacker can still detect it through DNS lookups or timing.

Why it matters

• Theft of cloud credentials and a full cloud account compromise.
• Access to internal services that were never meant to be public.
• Port scanning of your internal network from a trusted host.

How to prevent it

• Allow-list the domains and protocols the server may fetch; deny everything else.
• Block requests to private, loopback and link-local addresses, and re-check after DNS resolution and redirects.
• Require the newer, token-based cloud metadata service where your cloud provider offers it.
• Keep URL-fetching features on a separate, network-restricted service.

How Vooki Pro helps

• Tests for SSRF against internal addresses, cloud metadata endpoints, file:// URLs and DNS-based SSRF, including blind SSRF.
• Includes SSRF checks specific to APIs, from the OWASP API Security Top 10.
• Groups cloud SSRF findings by host and variant so one weak parameter does not flood your report.
• Shows the request, the response and the injected parameter as evidence.

Frequently asked questions

What is blind SSRF?

Blind SSRF is when the server makes the attacker-controlled request but does not return the response. It can still be detected through DNS lookups, timing or out-of-band interactions.

Why is SSRF so dangerous in the cloud?

Cloud instances can query a metadata service for temporary credentials. An SSRF that reaches it can hand an attacker access to the whole cloud account.

Related: Server-side template injection (SSTI) · IDOR and broken object-level authorization (BOLA)