SSRF File Get Contents URL
A user-controlled URL flows into file_get_contents()/fopen(), which transparently fetch remote URLs and can be abused for SSRF (CWE-918) or to read internal resources via file://, php://, and http:// wrappers.
Standards mapping
- OWASP Top 10
- A10:2021 - Server-Side Request Forgery (SSRF)
- OWASP ASVS
- V12.6.1 (L1)
Vulnerable vs. safe
return file_get_contents($feedUrl);return file_get_contents($feedUrl);Why it matters & how to fix it
A user-controlled URL flows into file_get_contents()/fopen(), which transparently fetch remote URLs and can be abused for SSRF (CWE-918) or to read internal resources via file://, php://, and http:// wrappers. Validate against a host allow-list and reject private/link-local IP ranges; prefer a hardened HTTP client with protocol restrictions.
References
Rule ID integsec-php-ssrf-file-get-contents-url - engine: Opengrep - license: MIT - Copyright (c) IntegSec Inc.
TurboPentest runs this check automatically
Connect a GitHub repo and this check runs on every white-box pentest - AI-validated and reported with proof, from $99 per target.
Start a pentestRelated checks
- PHP - Server-Side Request Forgery (SSRF)Open Redirect
- PHP - Server-Side Request Forgery (SSRF)SSRF Curl
- PHP - Authentication & SecretsDisabled TLS Verification
- PHP - Authentication & SecretsHardcoded Credentials
- PHP - Authentication & SecretsHardcoded DB Credentials
- PHP - CryptographyInsecure Random Token