The fix, in one snippet
reject loopback, RFC1918, link-local, metadata and non-HTTP schemesIllustrative values. Change the paths, hostnames and options to match your own site before using it.
The sections below explain what is tested, why it matters and the alternatives.
What we test
For verified hostnames only, Scan.now supplies a unique HTTPS callback to URL-like GET parameters and correlates inbound requests. It never supplies private-network or cloud-metadata addresses.
Why it matters
SSRF can expose internal services and cloud instance credentials through a public server.
How to fix it
Allow-list destinations, resolve and validate every redirect hop, block private and metadata networks and restrict outbound network access.
Where this fits
Server-side request forgery is check 2 of 19 that the ssrf vulnerability scanner runs under page content and javascript, ordered the way they are worth fixing. That ordering is the point: Fixing this one while the check above it still fails buys less than it looks like.
Fix this one first
Above it in the same category sits SQL injection (critical), where a GET parameter produced a repeatable database-error or boolean-response SQL injection indicator. An attacker who has that does not need this, so it is the better use of the same hour.
What fixing this still leaves open
Server-side request forgery closes one route in. Immediately below it: Form submits over HTTP, where a form on the page submits to a plain-HTTP URL; JavaScript library with known vulnerabilities, where the page loads a JavaScript library version with published vulnerabilities; Mixed content (HTTP resources on an HTTPS page), where the HTTPS page loads scripts, styles, frames or media over plain HTTP.
Found in the same scan
The ssrf vulnerability scanner reports this alongside checks from other categories that are at least as serious, including Path traversal / local file inclusion, where a path-like parameter returned a known local operating-system file signature. A single run of ssrf vulnerability scanner answers all of them at once.
The first few lines
You are a senior web engineer. I ran a security and SEO scanner against my site and it reported the finding below. Fix it properly rather than suppressing the symptom.
Finding: Server-side request forgery (critical severity)
Scanner check id: ssrf-activeThe rest of this prompt names the pages and line numbers we found the problem on, the configuration to change, and the constraints a good answer has to respect. It is free, it just needs an account so the work is not scraped wholesale.
Sign in with GoogleSigning in is free and takes one click. We store your email address and nothing else.
