Browse / Bypasses / SSRF protections

Getting past SSRF protections

Host allow-lists, internal-address blocks, redirect and DNS checks on outbound requests. 94 disclosed reports got past one.

1. SSRF in Exchange leads to ROOT access in all instancesServer-Side Request Forgery (SSRF) · medium · Shopify
   587 votes
2. RCE and Complete Server Takeover of http://www.█████.starbucks.com.sg/Code Injection · critical · Starbucks
   572 votes
3. Insecure redirect rule results in bypassing ban redirect on certain pagesInsecure Direct Object Reference (IDOR) · medium · Roblox
   233 votes
4. SSRF on duckduckgo.com/iu/Server-Side Request Forgery (SSRF) · high · DuckDuckGo
   165 votes
5. DNS Rebinding SSRF in Burp Suite MCP Server Enables Internal Network Access via send_http1_request ToolServer-Side Request Forgery (SSRF) · PortSwigger Web Security
   144 votes
6. XSS on $shop$.myshopify.com/admin/ and partners.shopify.com via whitelist bypass in SVG icon for sales channel applicationsCross-site Scripting (XSS) - Stored · high · Shopify
   $5,00088 votes
7. Using special IPv4-mapped IPv6 addresses to bypass local IP banImproper Access Control - Generic · critical · Cloudflare Public Bug Bounty
   $7,50078 votes
8. X-Forward-For Header allows to bypass access restrictionsImproper Access Control - Generic · medium · Yelp
   73 votes
9. GitLab::UrlBlocker validation bypass leading to full Server Side Request ForgeryServer-Side Request Forgery (SSRF) · high · GitLab
   72 votes
10. Possible DOM XSS on app.hey.comCross-site Scripting (XSS) - DOM · high · Basecamp
    68 votes
11. SSRF Filter Bypass via Unblocked NAT64 Local-Use IPv6 Prefix (64:ff9b:1::/48)Server-Side Request Forgery (SSRF) · high · arkadiyt-projects
    65 votes
12. GraphQL query "namespace" leaks dataImproper Access Control - Generic · medium · GitLab
    64 votes
13. Unauthenticated Path Traversal and Command Injection in Trellix Enterprise Security Manager 11.6.10OS Command Injection · critical · Trellix
    60 votes
14. Bypass Email Verification using Salesforce -- Reproducible in gitlab.comViolation of Secure Design Principles · high · GitLab
    55 votes
15. EXIF metadata not stripped from JPG group logosInformation Disclosure · low · GitLab
    $50055 votes
16. Bypass of the SSRF protection in Event Subscriptions parameter.Server-Side Request Forgery (SSRF) · medium · Slack
    52 votes
17. DNS rebinding in --inspect (insufficient fix of CVE-2022-32212 affecting macOS devices)Improper Access Control - Generic · high · Internet Bug Bounty
    $4,20047 votes
18. Stealing Users OAUTH Tokens via redirect_uri Improper Authentication - Generic · medium · BOHEMIA INTERACTIVE a.s.
    44 votes
19. SSRF via URL Parser Differential in `normalize_request_url` (wlc)Server-Side Request Forgery (SSRF) · high · Weblate
    43 votes
20. DNS Rebinding AttackServer-Side Request Forgery (SSRF) · critical · arkadiyt-projects
    42 votes
21. Bypass Rate Limits on app.snapchat.com API Endpoint via X-Forwarded-For HeaderBusiness Logic Errors · medium · Snapchat
    40 votes
22. urlapi: off-by-one in custom scheme validation skips last characterOff-by-one Error · high · curl
    38 votes
23. Open redirect on app.hey.com bypasses HEY desktop's internal-origin allowlist and loads attacker content inside a HEY BrowserWindowOpen Redirect · medium · Basecamp
    33 votes
24. SSRF via filter bypass due to lax checking on IPsServer-Side Request Forgery (SSRF) · medium · Nextcloud
    $25033 votes
25. User session access due to Oauth whitelist host bypass and postMessageCross-Site Request Forgery (CSRF) · Mail.ru
    31 votes
26. libcurl: Host-Only Cookies Leak to Alternate IPv4 FormsMisconfiguration · curl
    30 votes
27. SSRF via potential filter bypass with too lax local domain checkingServer-Side Request Forgery (SSRF) · low · Nextcloud
    $25030 votes
28. Blind SSRF in "Integrations" by abusing a bug in Ruby's native resolver.Server-Side Request Forgery (SSRF) · HackerOne
    30 votes
29. Unauthenticated SSRF in Voxtelesys integration ('checkUrlForSsrf' Bypass via DNS rebinding)Server-Side Request Forgery (SSRF) · high · Rocket.Chat
    28 votes
30. Open TURN relay abuse is possible due to lack of peer access control (Critical)Server-Side Request Forgery (SSRF) · high · 8x8
    $70023 votes
31. URN Request bypass ACL ChecksImproper Access Control - Generic · critical · Internet Bug Bounty
    23 votes
32. Improper handling of request URLs in nextcloud/guests allows guest users to bypass app allowlistImproper Handling of URL Encoding (Hex Encoding) · medium · Nextcloud
    22 votes
33. Incomplete VCS metadata exclusion: `.svn` / `.bzr` bypass CVE-2026-61792 due to missing `VCS_METADATA_DIRS` entries.Path Traversal · medium · Weblate
    21 votes
34. Incorrect Parsing of IPv6 Zone ID in curlAuthentication Bypass by Primary Weakness · high · curl
    21 votes
35. Bypassing Whitelist to perform SSRF for internal host scanningServer-Side Request Forgery (SSRF) · low · U.S. Department of State
    21 votes
36. Blind HTTP GET SSRF via website icon fetch (bypass of pull#812)Server-Side Request Forgery (SSRF) · low · Bitwarden
    21 votes
37. SSRF at iris.lystit.comServer-Side Request Forgery (SSRF) · low · Lyst
    21 votes
38. Protocol Smuggling / CRLF Injection via Gopher Protocol allows Arbitrary Command InjectionCRLF Injection · high · curl
    20 votes
39. Title: Use-After-Free in cURL Test Suite via Improper Cleanup of Global HandleUse After Free · high · curl
    20 votes
40. SSRF protection bypassServer-Side Request Forgery (SSRF) · medium · Nextcloud
    $10018 votes
41. Unauthenticated IP allowlist bypass when accessing job artifacts through gitlab pages at `{group_id}.gitlab.io`Improper Access Control - Generic · medium · GitLab
    17 votes
42. [h1-415 2020] h1ctf{y3s_1m_c0sm1c_n0w}Improper Access Control - Generic · critical · h1-ctf
    17 votes
43. DNS rebinding in --inspect (insufficient fix of CVE-2022-32212 affecting macOS devices)Improper Access Control - Generic · high · Node.js
    16 votes
44. Improper Input Validation on https://oberlo-image-proxy.shopifycloud.com/Shopify
    16 votes
45. Rate limit function bypass can leads to occur huge critical problem into website. Improper Access Control - Generic · medium · Courier
    16 votes
46. Unauthenticated blind SSRF in Circles signature verification bypasses Nextcloud local-address protectionsServer-Side Request Forgery (SSRF) · medium · Nextcloud
    15 votes
47. 2 Bypass of #1067533 rate limit via X-Forwarded-For<space>: Source IP on ( www.trycourier.app )Uncontrolled Resource Consumption · medium · Courier
    15 votes
48. SSRF bypassServer-Side Request Forgery (SSRF) · low · Concrete CMS
    15 votes
49. The endpoint '/test/webhooks' is vulnerable to DNS RebindingServer-Side Request Forgery (SSRF) · medium · Omise
    14 votes
50. [api.easy2pay.co] SQL Injection in cashcard via card_no parameter ⭐️Bypassing IP whitelist⭐️SQL Injection · Razer
    14 votes
51. CSRF: Replacing the router configuration backup having an 'operator' user and bypassing the "Referer:' whitelist protectionCross-Site Request Forgery (CSRF) · critical · Ubiquiti Inc.
    14 votes
52. Bypass of the SSRF protection (Slack commands, Phabricator integration)Server-Side Request Forgery (SSRF) · Slack
    $10014 votes
53. CURLOPT_HAPROXY_CLIENT_IP lacks input validation, enabling HAProxy PROXY protocol injectionCRLF Injection · medium · curl
    13 votes
54. CSS injection via link tag whitelisted-domain bypass - https://www.glassdoor.comImproper Access Control - Generic · Glassdoor
    13 votes
55. Server-Side Request Forgery in "icons.bitwarden.net"Server-Side Request Forgery (SSRF) · medium · Bitwarden
    13 votes
56. RCE due to Web Console IP Whitelist bypass in Rails 4.0 and 4.1Code Injection · Ruby on Rails
    13 votes
57. Container escape on public GitLab CI runnersImproper Access Control - Generic · high · GitLab
    12 votes
58. SSRF protection bypass in /appsuite/api/oxodocumentfilter addfile actionServer-Side Request Forgery (SSRF) · Open-Xchange
    $55012 votes
59. Blacklist bypass on Callback URLsInformation Disclosure · Coinbase
    $10012 votes
60. Arbitrary file download via "Save .torrent file" option can lead to Client RCE and XSSCode Injection · medium · Brave Software
    11 votes
61. Trailing-dot IPv4 URL bypasses IP-address guard, allows wildcard DNS SAN matchBusiness Logic Errors · curl
    10 votes
62. SSRF mitigation bypass using DNS Rebind attackServer-Side Request Forgery (SSRF) · low · Concrete CMS
    10 votes
63. AWS subdomain takeover of www.███████Improper Access Control - Generic · high · U.S. Dept Of Defense
    10 votes
64. Ability to add pishing links in discusion ," Bypassing uneductional Links add "Information Disclosure · Udemy
    10 votes
65. CRLF Injection in HAProxy PROXY Protocol via CURLOPT_HAPROXY_CLIENT_IP allows IP spoofing and protocol injectionCRLF Injection · medium · curl
    9 votes
66. CVE-2022-27780: percent-encoded path separator in URL hostServer-Side Request Forgery (SSRF) · medium · curl
    9 votes
67. XXE in Enterprise Search's App Search web crawlerXML External Entities (XXE) · critical · Elastic
    9 votes
68. redirect_to(["string"]) remote code executionInformation Exposure Through an Error Message · low · Ruby on Rails
    9 votes
69. [h1-ctf] 12 Days of Adventure to stop Grinch from ruining Christmash1-ctf
    9 votes
70. Bypass of SSRF VulnerabilityServer-Side Request Forgery (SSRF) · high · Node.js third-party modules
    9 votes
71. inconsistently Rejection Logic in file:// URLs with AuthorityPath Traversal · low · curl
    7 votes
72. Hackyholidays [ h1-ctf] writeup [mission:- stop the grinch ]Improper Access Control - Generic · critical · h1-ctf
    7 votes
73. [ Hacky Holidays CTF ] Completely taken down the Grinch NetworksServer-Side Request Forgery (SSRF) · critical · h1-ctf
    6 votes
74. 53: HTTP/1 CONNECT chunked-407 trailers bypass CURLOPT_SUPPRESS_CONNECT_HEADERS and lose CURLH_CONNECT classificationImproper Access Control - Generic · curl
    5 votes
75. Potential Authentication Bypass through "autologin" featureImproper Authentication - Generic · low · ImpressCMS
    5 votes
76. DNS rebinding in --inspect (insufficient fix of CVE-2018-7160)Improper Access Control - Generic · high · Node.js
    $5005 votes
77. URI scheme bypass in mail app lead to HTML content spoof and opener controlViolation of Secure Design Principles · Nextcloud
    5 votes
78. DNS rebinding in --inspect via invalid octal IP addressOS Command Injection · medium · Node.js
    4 votes
79. [CTF] I've DDoSed Grinch NetworkUncontrolled Resource Consumption · critical · h1-ctf
    4 votes
80. [H1-2006 2020] CTF writeuph1-ctf
    4 votes
81. [localhost-now] bypassing url filter which leads to read content of arbitrary filePath Traversal · high · Node.js third-party modules
    4 votes
82. Open redirect in fastify-static via mishandled user's input when attempt to redirectOpen Redirect · low · Fastify
    3 votes
83. Abusing URL Parsers by long schema nameServer-Side Request Forgery (SSRF) · curl
    3 votes
84. [H1-2006 2020] CTF Writeupcritical · h1-ctf
    3 votes
85. [H1-2006 2020] [CTF Writeup] A story about Bounty Payments, Collaboration & CommunityPrivilege Escalation · critical · h1-ctf
    3 votes
86. H1 Hackyholidays CTF - The Grinch was defeatedcritical · h1-ctf
    2 votes
87. [h1ctf-Grinch Networks] MrR3b00t Saving the Christmascritical · h1-ctf
    2 votes
88. CRLF Injection in legacy url API (url.parse().hostname)CRLF Injection · medium · Node.js
    2 votes
89. [expressjs-ip-control] Whitelist IP bypass leads to authorization bypass and sensitive info disclosureInformation Disclosure · medium · Node.js third-party modules
    2 votes
90. Incomplete IDN hostname check on the transfer path can lead to credential disclosure to an unintended hostInformation Disclosure · low · curl
    1 votes
91. It's just a man on a missioncritical · h1-ctf
    1 votes
92. [H1 hackyholidays] CTF WriteupInformation Disclosure · critical · h1-ctf
93. Successfully took down the Grinch and saved the holidays from being ruinedcritical · h1-ctf
94. [hacky-holidays] Grinch network is downcritical · h1-ctf