One supplied URL.
One compromised server.
The server visits URLs on your behalf — including internal addresses no user should ever reach. No suspicious click, no compromised browser: the backend connects to internal resources from a simple URL input.
URL supplied by the user
A URL field accepts an external target
The server loads the address supplied by the user as a trusted resource.
Attack flow
Attacker
sends the URL
Web server
makes the request
Internal network
protected service
Stolen data
returned to the attacker
A URL field is a secret backdoor
Logo import, link previews, document conversion... Any supplied URL can make the server connect to an external or internal service if it isn't checked.
Key figures
A10
OWASP Top 10 · 2021
Server-Side Request Forgery
0
Clicks required
for backend SSRF
169.254.169.254
Cloud host
metadata access
~€0,0M
Average cost
of a cloud data breach
Technical demo
Try it yourself
Simulate an SSRF by entering a URL. Watch how the server can reach an internal service or a cloud metadata endpoint if the URL isn't validated.
Enter a malicious URL
This demonstration shows how a vulnerable server follows a URL supplied by the attacker and reaches internal resources invisible to the browser.
Click "Simulate the request"…
Recommended protection
- Validate and normalize every URL received server-side.
- Reject internal hosts, localhost and the 169.254.x.x range.
- Use a whitelist of allowed external URLs.
Simulated network flow
Attacker
Malicious URL
Vulnerable server
backend
Internal service
not reached