Server-Side Request Forgery (SSRF) Detection — ShipSafe
How ShipSafe detects SSRF vulnerabilities in your code.
67 detection rulesLocal-only scanning
What is SSRF?
Server-Side Request Forgery (SSRF) occurs when an attacker can make the server send HTTP requests to arbitrary destinations. This can expose internal services, cloud metadata endpoints (like AWS IMDSv1 at 169.254.169.254), and private network resources that should not be accessible from the internet.
What ShipSafe Detects
- ✓User-controlled URLs in fetch(), axios, http.get(), and request libraries
- ✓Missing URL validation and allowlist enforcement
- ✓DNS rebinding attacks through TOCTOU vulnerabilities
- ✓IP allowlist bypass using decimal, octal, or hex IP representations
- ✓Redirect-based SSRF through HTTP 3xx responses
- ✓Cloud metadata endpoint access (AWS, GCP, Azure IMDS)
- ✓Internal network scanning via user-controlled host parameters
Example: Vulnerable Code
Vulnerable URL preview endpoint with SSRF
// Vulnerable: user-controlled URL in server-side fetch
app.post("/preview", async (req, res) => {
const { url } = req.body;
const response = await fetch(url);
const html = await response.text();
res.json({ preview: html.slice(0, 500) });
});
// An attacker sends url: "http://169.254.169.254/latest/meta-data/iam/security-credentials/"ShipSafe Catches It
$ shipsafe scan CRITICAL ssrf/user-controlled-url src/routes/preview.ts:3 User input from req.body controls the URL in a server-side HTTP request. Fix: Validate URL against an allowlist of permitted domains. Block private IPs and cloud metadata endpoints.
Detect SSRF in Your Code
Install ShipSafe and scan your project in under 60 seconds.
npm install -g @shipsafe/cli