SSRF
Server-side request forgery
An attacker makes the server send a request to a destination of the attacker’s choosing, often an internal service or a cloud metadata endpoint the attacker cannot reach directly.
- Fix it in your stack
- Server-side request forgery (SSRF) fix cards (10 stacks) · CWE-918 page
- Defined in
- MITRE CWE-918
- Identifiers
- CWE-918: Server-side request forgery (SSRF)
Covered in
Constrain server-side fetches to their intended destinations
Prevent untrusted URLs from turning a preview, import, or webhook feature into access to internal services.
Redirect users only to destinations you control
Check every redirect target taken from a request, so attackers cannot borrow your domain for phishing, carry OAuth tokens off-site or steer a server-side fetcher through your redirects.
Apply a security baseline across AWS, Azure and Google Cloud
Give workloads platform identities instead of keys, guard the instance metadata endpoint, block public storage, keep audit logs past the default retention, close inbound admin ports and use the native secret store, with tested Terraform for AWS, Azure and Google Cloud.
Convert untrusted office documents and PDFs in an isolated parser
DOCX, XLSX and ODF files are ZIP archives of XML, and PDFs can carry scripts; the converters that read them are large C and C++ programs with a long CVE history. Check the package before any parser reads it, convert each document in a container with no network, no writable root and hard limits, kill it at a deadline, and re-render to pixels when people will open the result.
Constrain MCP and multi-agent trust boundaries
Validate each connection and delegated action without treating a token for another service, a tool description, another agent or a state handle as authority.
Defend JWTs against forgery, confusion and replay
Verify a JWT as an issuer-, type- and audience-bound assertion with an algorithm allowlist and trusted keys, closing the alg "none", key-confusion, header-injection, weak-secret and replay attacks.
All 10 pages that cover SSRF in the library
Practice: SSRF lab: Guard an outbound fetch against SSRF · JWT verification lab: Verify a JWT before trusting it · SSRF validation lab: Validate a fetch URL with ipaddress · Open redirect lab: Return users to this site only