Impact
Server-Side Request Forgery (SSRF) is a critical vulnerability that allows an attacker to induce a server-side application to make requests to an unintended location [S1]. This can lead to the exposure of sensitive internal services, unauthorized access to cloud metadata endpoints, or the bypassing of network firewalls [S1].
Root Cause
SSRF typically occurs when an application processes user-supplied URLs without adequate validation, allowing the server to be used as a proxy for malicious requests [S1]. Beyond active flaws, the overall security posture of a site is heavily influenced by its HTTP header configurations [S2]. Launched in 2016, Mozilla's HTTP Observatory has analyzed over 6.9 million websites to help administrators strengthen their defenses against these common threats by identifying and addressing potential security vulnerabilities [S2].
How FixVibe tests for it
FixVibe's verified active scans flag blind SSRF on domains you own, and its passive scans flag missing or weak CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy headers.