Security Test: SSRF Injection in headers via Frontend¶

Description¶

Default Severity: low

When a web app uses a URL provided in headers without checking it, it can be tricked into requesting resources that might be hidden on internal networks, such as sensitive APIs or services behind a firewall. This vulnerability occurs because developers sometimes assume that data coming through headers is safe or rely too much on network boundaries to protect internal systems. The risk is that an attacker can manipulate these URLs to access confidential information, perform internal scans, or even use the server as a stepping stone for further attacks. Keeping an eye on input validation and not relying solely on network segmentation for security can help prevent these types of issues.

Configuration¶

Identifier: frontend_request_forgery/ssrf_header

Examples¶

All configuration available:

checks:
  frontend_request_forgery/ssrf_header:
    skip: false # default

Compliance and Standards¶