ssrf

name	ssrf
description	Detect Server-Side Request Forgery where user-controlled URLs can reach internal services, cloud metadata endpoints, or bypass network boundaries.
metadata	{"filePattern":["**/*.js","**/*.ts","**/*.py","**/*.go","**/*.rb"],"bashPattern":["semgrep.*ssrf","grep.*(fetch|axios|requests\\.get|http\\.get)"],"priority":85}

SSRF Detection

When to Use

Audit webhook handlers, URL preview generators, import-from-URL features, image proxy endpoints, PDF generators that fetch remote resources, and any endpoint that makes HTTP requests based on user-supplied URLs.

Process

Step 1: Find HTTP Request Sinks

# JavaScript
grep -rn "fetch(\|axios\|got(\|node-fetch\|http\.get\|https\.get\|request(" .
grep -rn "urllib\|url\.parse\|new URL(" .

# Python
grep -rn "requests\.get\|requests\.post\|urllib\.request\|urlopen\|httpx" .

# Go
grep -rn "http\.Get\|http\.Post\|http\.NewRequest\|httpClient" .

# Ruby
grep -rn "Net::HTTP\|open-uri\|Faraday\|HTTParty\|RestClient" .

Step 2: Check If URL is User-Controlled

Trace the URL parameter backwards:

• Does it come from request parameters, body, headers?
• Is it stored in database but originally user-supplied?
• Can the user control the host/port/path/scheme?

Step 3: Check URL Validation

grep -rn "isPrivate\|isInternal\|isLocalhost\|blocked\|allowlist\|blocklist" .
grep -rn "127\.0\.0\.1\|0\.0\.0\.0\|169\.254\|10\.\|172\.16\|192\.168" .

Step 4: Test IP Validation Bypasses

Common bypass techniques:

• Decimal IP: 2130706433 = 127.0.0.1
• Hex IP: 0x7f000001 = 127.0.0.1
• Octal IP: 0177.0.0.1 = 127.0.0.1
• IPv6 mapped: ::ffff:127.0.0.1
• IPv6 localhost: ::1, 0:0:0:0:0:0:0:1
• URL encoding: http://127%2e0%2e0%2e1
• DNS rebinding: domain that resolves to 127.0.0.1 after initial check
• Redirect following: allowed URL redirects to internal URL
• 0.0.0.0 on some systems maps to localhost
• localtest.me resolves to 127.0.0.1

Step 5: Check Protocol Handling

Dangerous protocols beyond http/https:

• file:///etc/passwd -- local file read
• gopher:// -- arbitrary TCP data (SSRF amplifier)
• dict:// -- dictionary service probe
• ftp:// -- FTP data exfiltration

Step 6: Evaluate Cloud Metadata Access

If the target runs on cloud infrastructure:

• AWS IMDSv1: http://169.254.169.254/latest/meta-data/iam/security-credentials/
• AWS IMDSv2: requires token header (harder to exploit)
• GCP: http://metadata.google.internal/computeMetadata/v1/
• Azure: http://169.254.169.254/metadata/instance
• DigitalOcean: http://169.254.169.254/metadata/v1/

CVSS Guidance

• SSRF to cloud credentials (AWS IMDSv1): CRITICAL 9.1
• SSRF to internal service interaction: HIGH 7.5
• Blind SSRF (no response body): MEDIUM 5.3-6.5
• SSRF with redirect-only: MEDIUM 5.0
• Authenticated SSRF: reduce PR to L

References

• Sinks -- HTTP request sinks by language
• False Positive Indicators
• PoC Skeleton