CWE-918: Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
How it's found
Server-Side Request Forgery (SSRF) is typically found by tracing untrusted input from where it enters the system to the point where it is used without the check or neutralization this weakness describes, combining manual code review with dynamic testing.
Vulnerable vs. safe
# User-controlled input
# Fetch the content of the provided URL
$url = $_GET['url'];$response = file_get_contents($url);echo $response;# Define allowed URLs (or domains)
# Get the user-provided URL
# Validate against allowed URLs
# Fetch content safely
# Escape output for safety
'https://example.com/data.json','https://api.example.com/info',
http_response_code(400);echo "Invalid or unauthorized URL.";exit;
http_response_code(500);echo "Failed to fetch content.";exit;$allowed_urls = [];$url = $_GET['url'] ?? '';if (!in_array($url, $allowed_urls)) {}$response = @file_get_contents($url);if ($response === false) {}echo htmlspecialchars($response);Consequences
- Read Application Data
- Execute Unauthorized Code or Commands
- Bypass Protection Mechanism: By providing URLs to unexpected hosts or ports, attackers can make it appear that the server is sending the request, possibly bypassing access controls such as firewalls that prevent the attackers from accessing the URLs directly. The server can be used as a proxy to conduct port scanning of hosts in internal networks, use other URLs such as that can access documents on the system (using file://), or use other protocols such as gopher:// or tftp://, which may provide greater control over the contents of requests.
How TurboPentest tests for this
TurboPentest's automated black-box pentest actively probes for Server-Side Request Forgery (SSRF) using Nuclei and OWASP ZAP, with no source code required. Connecting a GitHub repo adds white-box confirmation from IntegSec's Opengrep SAST rule pack, which carries 8 dedicated rules for this weakness.
Tools: Nuclei, OWASP ZAP
Frequently asked questions
What is CWE-918?
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
How do you find Server-Side Request Forgery (SSRF)?
Server-Side Request Forgery (SSRF) is typically found by tracing untrusted input from where it enters the system to the point where it is used without the check or neutralization this weakness describes, combining manual code review with dynamic testing.
What is the impact of CWE-918?
Read Application Data Execute Unauthorized Code or Commands Bypass Protection Mechanism: By providing URLs to unexpected hosts or ports, attackers can make it appear that the server is sending the request, possibly bypassing access controls such as firewalls that prevent the attackers from accessing the URLs directly. The server can be used as a proxy to conduct port scanning of hosts in internal networks, use other URLs such as that can access documents on the system (using file://), or use other protocols such as gopher:// or tftp://, which may provide greater control over the contents of requests.
Does TurboPentest test for Server-Side Request Forgery (SSRF)?
TurboPentest's automated black-box pentest actively probes for Server-Side Request Forgery (SSRF) using Nuclei and OWASP ZAP, with no source code required. Connecting a GitHub repo adds white-box confirmation from IntegSec's Opengrep SAST rule pack, which carries 8 dedicated rules for this weakness.
Related CWEs
Written and reviewed by
Michel Chamberland - Founder & CEO, IntegSec
CISSP, OSCP, OSCE, CEH, GIAC, CCSK · 20+ years in offensive security
Michel has spent 20+ years on offensive security teams including IBM X-Force Red and Trustwave SpiderLabs, leading penetration tests, red team engagements, and breach response for Fortune 500 customers. He is the founder of IntegSec and the architect of TurboPentest.
Find these issues before an attacker does
TurboPentest runs an agentic AI pentest against your target and reports findings with proof, from $99 per target.
Start a pentest