Request Forgery: SSRF Injection in headers¶

Identifier: ssrf_header

Scanner(s) Support¶

Description¶

SSRF injection in headers happens when a web app fetches a remote resource using a URL supplied by a user without checking it properly. An attacker can then trick the system into making requests to unintended destinations, like internal systems or services behind a firewall. This can expose internal APIs, lead to data breaches, or even be a pathway to further attacks. Developers often overlook proper input validation or rely too much on network boundaries for security, which can leave these vulnerabilities open.

Configuration¶

Example¶

Example configuration:

---
security_tests:
  ssrf_header:
    assets_allowed:
    - REST
    - GRAPHQL
    - WEBAPP
    skip: false

Reference¶

assets_allowed¶

Type : List[AssetType]*

List of assets that this check will cover.

skip¶

Type : boolean

Skip the test if true.