Security Test: Partial SSRF¶

Description¶

Default Severity: high

Partial SSRF happens when a server makes an external request based on user-controllable information, and an attacker can subtly influence that request. This might allow them to access internal services or data the server shouldn’t normally reach, creating a risk of unauthorized data exposure or even remote code execution. Often, developers unintentionally enable this by trusting portions of user input when building server requests, making it easier for attackers to sneak in malicious parameters. It’s dangerous because it opens an indirect path to critical internal systems that typically wouldn’t be accessible from the outside, so understanding where and how you use user inputs in server requests is key to preventing these types of vulnerabilities.

Reference:

• https://0xn3va.gitbook.io/cheat-sheets/web-application/graphql-vulnerabilities#abuse-graphql-as-an-api-gateway

Configuration¶

Identifier: request_forgery/ssrf_partial

Examples¶

All configuration available:

checks:
  request_forgery/ssrf_partial:
    skip: false # default
    options:
      skip_objects: # cf. Options below

Options¶

Options can be set in the options key of the Security Test Configuration.

Compliance and Standards¶