SSRF: From URL Parser to Server-Side Impact

SSRF is a confused-deputy problem: the server fetches a URL the client influenced. The journal studies parsers, redirect policy, and reachability — not a list of bypass hostnames.

Impact is whatever that fetch can touch: cloud metadata, internal admin ports, or file handlers. We document classes, not targeting recipes.

The vulnerability is allowing a caller to choose the authority of a server-side request without a policy that matches the trust boundary.

Link unfurling, webhook testers, PDF renderers, import-from-URL features, avatar fetchers, and AI tools that retrieve user-supplied links for RAG.

Any parameter named url, href, callback, webhook, icon, or source that leaves the process. Hidden surfaces: Open Graph fetchers and document converters that resolve images.

The failed assumption is “a URL is a string we can allowlist with startsWith(https).” Parsers disagree about scheme, userinfo, redirects, DNS rebinding, and alternate IP notations. Root cause is policy applied to the wrong parse stage.

The research object is the parser pipeline, not the final HTTP client call alone.

SSRF is usually reachability and information disclosure. It becomes a step toward RCE only when the fetched resource is then deserialized, rendered in a native parser, or delivered to an admin execution feature. Say “SSRF” until that hop is proven.

Mature patches check the URL after redirects and after resolution, deny link-local and metadata ranges in the running environment, and pin allowed hosts. Patches that only block a hostname string are incomplete — record that as a residual-risk note, validated privately.

Inventory outbound HTTP clients. Require a named policy object next to each one. In production, log destination class (public, private, denied) without logging full secrets from the response.

Fetch only from an allowlisted set of hosts, from an isolated network namespace with no metadata and no RFC1918 routes. Disable protocols you do not need. Do not pass fetch results into deserializers or native converters without a second boundary.

If your note is a list of bypass strings, you wrote an attack guide. If your note names the parse stage that was skipped, you wrote research.

OWASP, Server-Side Request Forgery — class and defensive controls.

CWE-918 — after the deputy and destination class are identified.

Art of Vector Security disclosure policy — /about/responsible-disclosure.