Security Test: Server Side Request Forgery¶

Description¶

Default Severity: high

Server Side Request Forgery happens when an application blindly sends a request to a URL provided by a user. Without proper checks, attackers can supply a URL that directs the request to an internal service or a restricted resource, helping them bypass security boundaries like firewalls or VPN protections. This oversight can let attackers expose sensitive internal systems or data, and might even be used as a stepping stone for more intrusive attacks. Developers often face this risk when they don’t implement strict input validation and proper URL filtering, making it a small mistake with serious potential impact if left unaddressed.

Configuration¶

Identifier: request_forgery/ssrf

Examples¶

All configuration available:

checks:
  request_forgery/ssrf:
    skip: false # default

Compliance and Standards¶