Browse / Server-Side Request Forgery

Server-Side Request Forgery

See it on the mapBypass libraryPayloads

Weaknesses in this class

• Server-Side Request Forgery (SSRF)329

Often found together with

• Information Disclosure53
• Code Execution38

Most upvoted Server-Side Request Forgery reports

AllValidInformativeN/ADuplicate

1. My Expense Report resulted in a Server-Side Request Forgery (SSRF) on LyftServer-Side Request Forgery (SSRF) · Lyft
   653 votes
2. SSRF in Exchange leads to ROOT access in all instancesServer-Side Request Forgery (SSRF) · medium · Shopify
   587 votes
3. Server Side Request Forgery (SSRF) via Analytics ReportsServer-Side Request Forgery (SSRF) · critical · HackerOne
   $25,000529 votes
4. Server-Side Request Forgery using Javascript allows to exfill data from Google MetadataServer-Side Request Forgery (SSRF) · Snapchat
   421 votes
5. Server Side Request Forgery (SSRF) at app.hellosign.com leads to AWS private keys disclosureServer-Side Request Forgery (SSRF) · Dropbox
   $4,913360 votes
6. SSRF on project import via the remote_attachment_url on a NoteServer-Side Request Forgery (SSRF) · high · GitLab
   $10,000359 votes
7. Server Side Request Forgery mitigation bypassServer-Side Request Forgery (SSRF) · high · GitLab
   350 votes
8. Blind SSRF to internal services in matrix preview_link APIServer-Side Request Forgery (SSRF) · high · Reddit
   $6,000344 votes
9. TURN server allows TCP and UDP proxying to internal network, localhost and meta-data servicesServer-Side Request Forgery (SSRF) · critical · Slack
   $3,500323 votes
10. Full Response SSRF via Google DriveServer-Side Request Forgery (SSRF) · Dropbox
    $17,576302 votes
11. SSRF leaking internal google cloud data through upload function [SSH Keys, etc..]Server-Side Request Forgery (SSRF) · critical · Vimeo
    276 votes
12. SSRF on fleet.city-mobil.ru leads to local file readServer-Side Request Forgery (SSRF) · Mail.ru
    272 votes
13. Full read SSRF in www.evernote.com that can leak aws metadata and local file inclusionServer-Side Request Forgery (SSRF) · critical · Evernote
    264 votes
14. SSRF in graphQL query (pwapi.ex2b.com)Server-Side Request Forgery (SSRF) · medium · EXNESS
    $3,000261 votes
15. Unauthenticated blind SSRF in OAuth Jira authorization controllerServer-Side Request Forgery (SSRF) · high · GitLab
    $4,000238 votes
16. SSRF & LFR on city-mobil.ruServer-Side Request Forgery (SSRF) · Mail.ru
    237 votes
17. Full Read SSRF on Gitlab's Internal GrafanaServer-Side Request Forgery (SSRF) · critical · GitLab
    229 votes
18. SSRF in webhooks leads to AWS private keys disclosureServer-Side Request Forgery (SSRF) · high · Omise
    214 votes
19. Stored XSS & SSRF in Lark DocsServer-Side Request Forgery (SSRF) · critical · Lark Technologies
    $3,000178 votes
20. SSRF on duckduckgo.com/iu/Server-Side Request Forgery (SSRF) · high · DuckDuckGo
    165 votes
21. Server Side Request ForgeryServer-Side Request Forgery (SSRF) · critical · Lark Technologies
    164 votes
22. External SSRF and Local File Read via video upload due to vulnerable FFmpeg HLS processingServer-Side Request Forgery (SSRF) · high · TikTok
    $2,727162 votes
23. SSRF in Autodesk Rendering leading to account takeoverServer-Side Request Forgery (SSRF) · critical · Autodesk
    161 votes
24. SSRF chained to hit internal host leading to another SSRF which allows to read internal images.Server-Side Request Forgery (SSRF) · high · PlayStation
    $1,000148 votes
25. DNS Rebinding SSRF in Burp Suite MCP Server Enables Internal Network Access via send_http1_request ToolServer-Side Request Forgery (SSRF) · PortSwigger Web Security
    144 votes
26. Blind SSRF on errors.hackerone.net due to Sentry misconfigurationServer-Side Request Forgery (SSRF) · low · HackerOne
    $3,500143 votes
27. SSRF in https://couriers.indrive.com/api/file-storageServer-Side Request Forgery (SSRF) · high · inDrive
    141 votes
28. Server Side Request Forgery (SSRF) in webhook functionalityServer-Side Request Forgery (SSRF) · medium · HackerOne
    $2,500140 votes
29. SSRF on music.line.me through getXML.phpServer-Side Request Forgery (SSRF) · high · LY Corporation
    $4,500135 votes
30. SSRF in clients.city-mobil.ruServer-Side Request Forgery (SSRF) · Mail.ru
    $1,500132 votes
31. SSRF in filtering on relap.ioServer-Side Request Forgery (SSRF) · Mail.ru
    130 votes
32. SSRF In Get Video ContentsServer-Side Request Forgery (SSRF) · medium · Semrush
    125 votes
33. Full read SSRF via Lark Docs `import as docs` feature Server-Side Request Forgery (SSRF) · critical · Lark Technologies
    $5,000124 votes
34. Blind SSRF on https://my.exnessaffiliates.com/ allows for internal network enumerationServer-Side Request Forgery (SSRF) · medium · EXNESS
    120 votes
35. Server-Side Request Forgery (SSRF) via Game Export APIServer-Side Request Forgery (SSRF) · critical · Lichess
    116 votes
36. [H1-415 2020] CTF WriteupServer-Side Request Forgery (SSRF) · critical · h1-ctf
    108 votes
37. SSRF on image rendererServer-Side Request Forgery (SSRF) · high · PlayStation
    $1,000103 votes
38. Header modification results in disclosure of Slack infra metadata to unauthorized partiesServer-Side Request Forgery (SSRF) · medium · Slack
    97 votes
39. [city-mobil.ru] SSRF & limited LFR on /taxiserv/photoeditor/save endpoint via base64 POST parameterServer-Side Request Forgery (SSRF) · Mail.ru
    95 votes
40. [my.stripo.email] Blind SSRF Vulnerability in Stripo App Export via Missing Endpoints Export Email Message to ZapierServer-Side Request Forgery (SSRF) · critical · Stripo Inc
    92 votes
41. Blind SSRF in horizon-heatServer-Side Request Forgery (SSRF) · Mail.ru
    $2,50091 votes
42. Reverse Proxy misroute leading to steal X-Shopify-Access-Token headerServer-Side Request Forgery (SSRF) · medium · Shopify
    $1,00090 votes
43. SSRF and LFI in site-audit toolServer-Side Request Forgery (SSRF) · high · Semrush
    86 votes
44. SSRF in api.slack.com, using slash commands and bypassing the protections.Server-Side Request Forgery (SSRF) · medium · Slack
    84 votes
45. Blind SSRF in emblem editor (2)Server-Side Request Forgery (SSRF) · medium · Rockstar Games
    $1,50083 votes
46. SVG Server Side Request Forgery (SSRF)Server-Side Request Forgery (SSRF) · low · Shopify
    $50081 votes
47. SSRF with bypass leads to client side hosting / vulnerabilities ( XSS and others )Server-Side Request Forgery (SSRF) · medium · DuckDuckGo
    $50077 votes
48. SSRF на https://qiwi.com с помощью "Prerender HAR Capturer"Server-Side Request Forgery (SSRF) · QIWI
    77 votes
49. SSRF via host header let access localhost via https://go.dialexa.comServer-Side Request Forgery (SSRF) · medium · IBM
    75 votes
50. Libuv: Improper Domain Lookup that potentially leads to SSRF attacksServer-Side Request Forgery (SSRF) · high · Internet Bug Bounty
    $4,86074 votes
51. GitLab::UrlBlocker validation bypass leading to full Server Side Request ForgeryServer-Side Request Forgery (SSRF) · high · GitLab
    72 votes
52. SSRF in CI after first runServer-Side Request Forgery (SSRF) · medium · GitLab
    72 votes
53. SSRF and secret key disclosure found on Turbonomic endpointServer-Side Request Forgery (SSRF) · high · IBM
    71 votes
54. mail.acronis.com is vulnerable to zero day vulnerability CVE-2022-41040Server-Side Request Forgery (SSRF) · critical · Acronis
    $1,00071 votes
55. Blind SSRF on debug.nordvpn.com due to misconfigured sentry instanceServer-Side Request Forgery (SSRF) · Nord Security
    70 votes
56. Sending Emails from DNSDumpster - Server-Side Request Forgery to Internal SMTP AccessServer-Side Request Forgery (SSRF) · Hacker Target
    69 votes
57. Lack of sanitization of the billing address in pdf invoiceServer-Side Request Forgery (SSRF) · high · Semrush
    66 votes
58. SSRF Filter Bypass via Unblocked NAT64 Local-Use IPv6 Prefix (64:ff9b:1::/48)Server-Side Request Forgery (SSRF) · high · arkadiyt-projects
    65 votes
59. connect.8x8.com: Blind SSRF via /api/v2/chats/image-check allows for Internal Ports scanServer-Side Request Forgery (SSRF) · medium · 8x8
    65 votes
60. SSRF with information disclosureServer-Side Request Forgery (SSRF) · medium · Lark Technologies
    64 votes
61. Link unfurling calls out to arbitrary URLs and the private-network guard misses link-local addressesServer-Side Request Forgery (SSRF) · medium · Basecamp
    62 votes
62. External service interaction (HTTP)Server-Side Request Forgery (SSRF) · high · AWS VDP
    62 votes
63. Blind SSRF External Interaction on ████████Server-Side Request Forgery (SSRF) · high · MTN Group
    61 votes
64. SSRF and local file disclosure by video upload on https://www.redtube.com/uploadServer-Side Request Forgery (SSRF) · Pornhub
    $50061 votes
65. SSRF Keycloak before 13.0.0 - CVE-2020-10770 on https://sponsoredata.mtn.ciServer-Side Request Forgery (SSRF) · medium · MTN Group
    60 votes
66. [SSRF] Server-Side Request Forgery at https://sea-web.gold.razer.com/dev/simulator via notify_url ParameterServer-Side Request Forgery (SSRF) · Razer
    $2,00060 votes
67. FogBugz import attachment full SSRF requiring vulnerability in *.fogbugz.comServer-Side Request Forgery (SSRF) · high · GitLab
    58 votes
68. Inappropriate URL parsing may cause security risk!Server-Side Request Forgery (SSRF) · medium · Internet Bug Bounty
    $1,00058 votes
69. SSRF to read AWS metaData at https://█████/ [HtUS]Server-Side Request Forgery (SSRF) · critical · U.S. Dept Of Defense
    $1,00057 votes
70. SSRF and secret key disclosure found on Turbonomic endpointServer-Side Request Forgery (SSRF) · high · IBM
    56 votes
71. [h1-415 2020] Multiple vulnerabilities leading to leaking of secret user filesServer-Side Request Forgery (SSRF) · critical · h1-ctf
    56 votes
72. Get-based SSRF limited to HTTP protocol on https://resizer.line-apps.com/formServer-Side Request Forgery (SSRF) · medium · LY Corporation
    $1,35056 votes
73. SSRF in hatchful.shopify.comServer-Side Request Forgery (SSRF) · low · Shopify
    $50056 votes
74. Blind SSRF on platform.dash.cloudflare.com Due to Sentry misconfigurationServer-Side Request Forgery (SSRF) · low · Cloudflare Public Bug Bounty
    54 votes
75. blind Server-Side Request Forgery (SSRF) allows scanning internal portsServer-Side Request Forgery (SSRF) · medium · Elastic
    54 votes
76. SSRF By adding a custom integration on console.helium.comServer-Side Request Forgery (SSRF) · high · Helium
    54 votes
77. Blind SSRF in magnum upgrade_paramsServer-Side Request Forgery (SSRF) · Mail.ru
    $2,50054 votes
78. Blind SSRF at https://chaturbate.com/notifications/update_push/Server-Side Request Forgery (SSRF) · high · Chaturbate
    54 votes
79. Internal Blind Server-Side Request Forgery (SSRF) allows scanning internal portsInformativeServer-Side Request Forgery (SSRF) · Mozilla
    53 votes
80. Blind SSRF vulnerability on cz.acronis.comServer-Side Request Forgery (SSRF) · medium · Acronis
    53 votes
81. SSRF and local file disclosure by video upload on https://www.tube8.com/Server-Side Request Forgery (SSRF) · Pornhub
    $50053 votes
82. Node.js permission model bypass via unchecked Unix Domain Socket connections (UDS)Server-Side Request Forgery (SSRF) · medium · Node.js
    52 votes
83. Unauthenticated full-read SSRF via Twilio integrationServer-Side Request Forgery (SSRF) · high · Rocket.Chat
    52 votes
84. Bypass of the SSRF protection in Event Subscriptions parameter.Server-Side Request Forgery (SSRF) · medium · Slack
    52 votes
85. SMB SSRF in emblem editor exposes taketwo domain credentials, may lead to RCEServer-Side Request Forgery (SSRF) · high · Rockstar Games
    $1,50052 votes
86. SSRF vulnerability can be exploited when a hijacked aggregated api server such as metrics-server returns 30XServer-Side Request Forgery (SSRF) · medium · Kubernetes
    $1,00051 votes
87. Bypassing domain deny_list rule in Smokescreen via trailing dot leads to SSRFServer-Side Request Forgery (SSRF) · low · Stripe
    51 votes
88. Internal SSRF bypass using slash commands at api.slack.comServer-Side Request Forgery (SSRF) · medium · Slack
    51 votes
89. BLIND SSRF ON http://jsgames.mail.ru via avaOp parameter Server-Side Request Forgery (SSRF) · Mail.ru
    49 votes
90. SSRF - Unchecked Snippet IDs for distributed filesServer-Side Request Forgery (SSRF) · Open-Xchange
    $1,50049 votes
91. CreatorID leaked from public content posted to SnapMapsServer-Side Request Forgery (SSRF) · medium · Snapchat
    $1,00049 votes
92. SSRF in VCARD photo upload functionalityServer-Side Request Forgery (SSRF) · Open-Xchange
    $85049 votes
93. SSRF via User-Controlled Push proxyServer in Notifications Push RegistrationServer-Side Request Forgery (SSRF) · medium · Nextcloud
    48 votes
94. SSRF in Functional Administrative Support Tool pdf generator (████) [HtUS]Server-Side Request Forgery (SSRF) · critical · U.S. Dept Of Defense
    $4,00046 votes
95. important: Apache HTTP Server on WIndows UNC SSRF (CVE-2024-38472)Server-Side Request Forgery (SSRF) · high · Internet Bug Bounty
    $4,92045 votes
96. SSRFServer-Side Request Forgery (SSRF) · Mail.ru
    44 votes
97. Upload profile photo from URLServer-Side Request Forgery (SSRF) · HackerOne
    44 votes
98. SSRF via URL Parser Differential in `normalize_request_url` (wlc)Server-Side Request Forgery (SSRF) · high · Weblate
    43 votes
99. Server-Side Request Forgery (SSRF) in Ghost CMS Server-Side Request Forgery (SSRF) · medium · Node.js third-party modules
    43 votes
100. XSPA on API service endpointServer-Side Request Forgery (SSRF) · Polymail, Inc.
     43 votes