Server Side Request Forgery

Server Side Request Forgery (SSRF) happens when untrusted input is used to construct requests to other resources, potentially on internal or external networks. SSRF can allow for unauthorised access to internal systems, data leakage, and in some cases, remote code execution.

Remediation

Where possible do not use untrusted input in a HTTP call.
Do not use string concatination to add utrusted input to parts of the URL.
Parse the URL using a safe library and check the parsed URL against a whitelist.

Metadata

Severity: medium
Slug: server-side-request-forgery

CWEs

918: Server-Side Request Forgery (SSRF)
639: Authorization Bypass Through User-Controlled Key
200: Exposure of Sensitive Information to an Unauthorized Actor

OWASP

A10:2021: Server-Side Request Forgery
API7:2023: Server-Side Request Forgery (SSRF)

Available Labs

Select a language to explore available labs for this vulnerability.

2 Labs

Csharp Labs

Csharp 2 labs

Explore 2 labs in Csharp.

2 Labs

Go Labs

Go 2 labs

Explore 2 labs in Go.

2 Labs

Java Labs

Java 2 labs

Explore 2 labs in Java.

2 Labs

Javascript Labs

Javascript 2 labs

Explore 2 labs in Javascript.

1 Lab

Openapi Labs

Openapi 1 lab

Explore 1 lab in Openapi.

1 Lab

Php Labs

Php 1 lab

Explore 1 lab in Php.

3 Labs

Python Labs

Python 3 labs

Explore 3 labs in Python.

2 Labs

Ruby Labs

Ruby 2 labs

Explore 2 labs in Ruby.

2 Labs

Typescript Labs

Typescript 2 labs

Explore 2 labs in Typescript.

No matching labs found

Try adjusting your language filter.

Play AppSec WarGames

Want to skill-up in secure coding and AppSec? Try SecDim Wargames to learn how to find, hack and fix security vulnerabilities inspired by real-world incidents.

For Companies Play Now

Got a comment?

Join our secure coding and AppSec community. A discussion board to share and discuss all aspects of secure programming, AppSec, DevSecOps, fuzzing, cloudsec, AIsec code review, and more.