High severityPHPServer-Side Request Forgery (SSRF)HIGH confidence
SSRF Curl
A user-controlled URL flows into a cURL request, enabling server-side request forgery (CWE-918).
Standards mapping
- OWASP Top 10
- A10:2021 - Server-Side Request Forgery (SSRF)
- OWASP ASVS
- V12.6.1 (L1)
Vulnerable vs. safe
Flagged by this check
curl_setopt($ch, CURLOPT_URL, $url);Passes - the safe pattern
curl_setopt($ch, CURLOPT_URL, $url);Why it matters & how to fix it
A user-controlled URL flows into a cURL request, enabling server-side request forgery (CWE-918). An attacker can pivot to internal services, cloud metadata endpoints (169.254.169.254), or file:// URLs. Validate the target against an allow-list of hosts, resolve and reject private/link-local IP ranges, and restrict the allowed protocols (CURLOPT_PROTOCOLS).
References
Rule ID integsec-php-ssrf-curl - engine: Opengrep - license: MIT - Copyright (c) IntegSec Inc.
TurboPentest runs this check automatically
Connect a GitHub repo and this check runs on every white-box pentest - AI-validated and reported with proof, from $99 per target.
Start a pentestRelated checks
- PHP - Server-Side Request Forgery (SSRF)Open Redirect
- PHP - Server-Side Request Forgery (SSRF)SSRF File Get Contents URL
- PHP - Authentication & SecretsDisabled TLS Verification
- PHP - Authentication & SecretsHardcoded Credentials
- PHP - Authentication & SecretsHardcoded DB Credentials
- PHP - CryptographyInsecure Random Token