HIGH SEVERITYCWE-918: SSRF

Server-Side Request Forgery

SSRF is a vulnerability where an attacker can cause the server-side application to make HTTP requests to an arbitrary domain of the attacker's choosing. This often targets internal systems that are not accessible from the external network.

Common Payloads

http://127.0.0.1:80

http://localhost:22

http://169.254.169.254/latest/meta-data/

file:///etc/passwd

dict://localhost:11211/stat

How to Prevent?

Sanitize and validate all user-supplied input.
Enforce a whitelist of allowed domains and protocols.
Disable unused protocols (like file://, dict://, gopher://).
Use a network-level firewall to restrict outgoing server traffic.

Back to Overview