Tested fixes for the weaknesses API7:2023 maps, in Express, Flask, Spring Boot, ASP.NET Core, Next.js, FastAPI, Django, net/http, Rails and Laravel: the vulnerable code, the fix, a wrong fix and the regression tests.
APIs that fetch caller-supplied URLs, for webhooks, file imports or link previews, can be pointed at internal services and cloud metadata endpoints.
- Isolate the component that fetches remote resources, and allowlist origins, URL schemes, ports and media types.
- Disable HTTP redirects, and validate every caller-supplied URL with a well-tested parser.
- Never return the raw fetched response to the caller.
Guides on this site
Practice
- SSRF lab: Guard an outbound fetch against SSRF · Browser lab
- SSRF validation lab: Validate a fetch URL with ipaddress · Browser lab
References
List data from the publisher. A guide is listed as the main subject when the weakness or risk is what the guide is about, and as covering it when a dedicated section or worked example addresses it.