SSRF
SSRF is a class of web security vulnerability in which an attacker manipulates the target server into issuing requests to internal network resources or sensitive interfaces on the attacker's behalf. It was designated as a standalone category, A10, in the OWASP Top 10 2021 list.
Core Facts
DNS Rebinding is an attack technique that exploits the DNS resolution time gap to bypass the same-origin policy by setting the DNS TTL to an extremely short value so that the domain resolves to 127.0.0.1 after the page has loaded.
SSRF is a class of web security vulnerability in which an attacker manipulates a server-side application into making HTTP requests to unintended internal or external addresses.
Vulnerabilities such as SQL injection, XSS, and SSRF have long occupied the OWASP Top 10 security risk list.
Timeline (last 90 days)
Common entry-level directions for SRC include medium- and low-risk vulnerabilities such as information disclosure, unauthorized access, XSS and SSRF; these vulnerabilities have low tool dependence and clear verification paths, making them suitable as practice targets.
Ars Technica reported on the inter-agent prompt injection problem: a compromised internal agent passes injected instructions to other agents that trust it, in some cases leading to server-side request forgery (SSRF).
Agent scenarios must guard against SSRF attacks, forbidding crawling of private IP ranges (10.x, 172.16.x, 192.168.x, 127.x) and the cloud metadata endpoint 169.254.169.254, and re-validating the actual IP after DNS resolution to prevent domain-rebinding bypasses.
Most similar web-scraping tools perform only a single DNS check, and an HTTP redirect can bypass their internal-address restrictions.
The Fetch MCP server by default rejects private, loopback, and link-local addresses (including the cloud metadata endpoint 169.254.169.254), and re-checks the target IP on every redirect hop.
The Webhook approach needs to guard against SSRF (server-side request forgery); mature implementations usually require the callback address to undergo ownership verification (such as sending a challenge and validating the response), and restrict target IP ranges with an allowlist.
SSRF's core defense is not a simple blacklist, but whitelist-style normalized validation of protocol, host, port, and path, along with restricting file reads to preset directories.
In LSCBench's Go language LocalAI SSRF task, GPT-5.6-Sol's GetURI reads any path passed in, including file:// URLs; the reference fix restricts reads to within the model directory, but no model did this.
In LSCBench, by vulnerability family, the highest combined functional + security pass rate for memory safety was 44%, for injection classes 28%, for SSRF only 3%, and for information exposure only 1%.
A file-read tool with path traversal, a URL fetch tool without target filtering (an SSRF vector), and a Shell execution tool without an allowlist (arbitrary code execution) are all exploitable items for indirect prompt injection.
23 more timeline events
All Facts (20)
DNS Rebinding is an attack technique that exploits the DNS resolution time gap to bypass the same-origin policy by setting the DNS TTL to an extremely short value so that the domain resolves to 127.0.0.1 after the page has loaded.
75%VerifiedSSRF is a class of web security vulnerability in which an attacker manipulates a server-side application into making HTTP requests to unintended internal or external addresses.
75%VerifiedVulnerabilities such as SQL injection, XSS, and SSRF have long occupied the OWASP Top 10 security risk list.
75%VerifiedThe 2019 Capital One data breach was related to SSRF combined with a metadata interface, resulting in the leak of information of hundreds of millions of users.
65%UnverifiedCommon entry-level directions for SRC include medium- and low-risk vulnerabilities such as information disclosure, unauthorized access, XSS and SSRF; these vulnerabilities have low tool dependence and clear verification paths, making them suitable as practice targets.
50%UnverifiedAgent scenarios must guard against SSRF attacks, forbidding crawling of private IP ranges (10.x, 172.16.x, 192.168.x, 127.x) and the cloud metadata endpoint 169.254.169.254, and re-validating the actual IP after DNS resolution to prevent domain-rebinding bypasses.
50%UnverifiedMost similar web-scraping tools perform only a single DNS check, and an HTTP redirect can bypass their internal-address restrictions.
50%UnverifiedThe Fetch MCP server by default rejects private, loopback, and link-local addresses (including the cloud metadata endpoint 169.254.169.254), and re-checks the target IP on every redirect hop.
50%UnverifiedThe Webhook approach needs to guard against SSRF (server-side request forgery); mature implementations usually require the callback address to undergo ownership verification (such as sending a challenge and validating the response), and restrict target IP ranges with an allowlist.
50%UnverifiedSSRF's core defense is not a simple blacklist, but whitelist-style normalized validation of protocol, host, port, and path, along with restricting file reads to preset directories.
50%UnverifiedIn LSCBench's Go language LocalAI SSRF task, GPT-5.6-Sol's GetURI reads any path passed in, including file:// URLs; the reference fix restricts reads to within the model directory, but no model did this.
50%UnverifiedIn LSCBench, by vulnerability family, the highest combined functional + security pass rate for memory safety was 44%, for injection classes 28%, for SSRF only 3%, and for information exposure only 1%.
50%UnverifiedA file-read tool with path traversal, a URL fetch tool without target filtering (an SSRF vector), and a Shell execution tool without an allowlist (arbitrary code execution) are all exploitable items for indirect prompt injection.
50%UnverifiedWhen constructing outbound requests, the MCP server directly uses the address provided by the Agent, without verifying where that address actually resolves to, which attackers can exploit to make the server access internal networks, cloud metadata interfaces, or other sensitive resources.
50%UnverifiedCommon practices for defending against SSRF include: resolving the target domain name to an IP and then determining whether it falls within restricted ranges such as private address ranges, link-local addresses, and loopback addresses; restricting protocols to only allow http/https; and re-performing validation after each redirect.
50%UnverifiedThe runtime proxy firewall's SSRF protection includes blocking internal URLs (such as localhost, 169.254.169.254, 10.x, 192.168.x), validating redirect chains (at most 3 hops, no protocol downgrade), preventing DNS rebinding, and extracting and validating embedded URLs through deep document inspection.
50%UnverifiedA single compromised MCP server can execute prompt injection, credential exfiltration, delivery of phishing toolkit fingerprints, PII leakage, token theft via OAuth, and SSRF attacks.
50%UnverifiedIf LLM output is rendered or executed without encoding, it can lead to XSS (when rendered as HTML/Markdown), SQL injection (when concatenated into database queries), and SSRF (when URLs are included for backend fetching).
50%UnverifiedBlocklisting private addresses and metadata addresses by default is the most fundamental and critical step in defending against SSRF attacks, and developers implementing MCP tools with network access capabilities should refer to this approach as a priority.
50%Unverifiedmcp-server-fetch rejects private addresses, loopback addresses, and metadata addresses by default as an SSRF protection measure.
50%