flawopen.com/SSRF/fetch() and SSRF

Is server-side fetch() vulnerable to SSRF by default?

Reference page — draft, pending review
ELI5

If your server fetches a URL that a user gets to choose, and you don't restrict which URLs are allowed, an attacker can make your server send requests to internal systems it can reach but the attacker can't reach directly — your server becomes a proxy for attacking your own internal network.

VULNERABLE
// server-side code fetching a
// user-supplied "webhook" or "avatar" URL
const res = await fetch(userProvidedUrl);
FIXED
const url = new URL(userProvidedUrl);
if (!isAllowedHost(url.hostname)) {
  throw new Error("URL not allowed");
}
const res = await fetch(url);

Why this matters more than it sounds

Any server-side feature that fetches a user-supplied URL — webhook registration, image/avatar-from-URL, PDF generation from a link, link preview generation — is a potential SSRF vector. The classic high-value target is a cloud provider's instance metadata endpoint (commonly http://169.254.169.254/), which on a misconfigured server can leak cloud credentials to whoever can get the server to fetch that URL.

FAQ

Is blocking "localhost" and private IP ranges enough?

It's a start but not sufficient alone — DNS rebinding, redirects, and alternate IP representations (decimal, octal) can bypass naive blocklists. An allow-list of specifically permitted destination hosts is more robust than a blocklist of forbidden ones.

References