VibeSecurity

Security check

Server-side request forgery (SSRF): when your server fetches a URL for a user

If your server fetches an address a user gives you, an attacker can point it at internal services or cloud metadata that the public internet cannot reach. Link previews, webhooks and image importers are common places.

By the VibeSecurity team1 min read

Features that take URLs

  • Link preview or unfurl features.
  • Import from URL for images or files.
  • User-configured webhooks.
  • AI features that fetch a page the user names.

Controls to apply

  • Accept only http and https, and only ports you expect.
  • Resolve the hostname and refuse loopback, private and link-local ranges, then connect to the resolved address to avoid DNS rebinding.
  • Limit redirects and re-check each hop.
  • Set short timeouts and response size caps.
  • Run fetchers with no access to internal networks or credentials where possible.

Cloud metadata

Cloud providers expose credentials on a link-local address. Use the provider's hardened metadata option and keep instance roles narrow.

Frequently asked questions

Is blocking the string localhost enough?

No. Attackers use alternative encodings and DNS names that resolve to internal addresses. Check the resolved address.

Sources

  1. 1.OWASP Server-Side Request Forgery Prevention Cheat Sheet