# Ssrf Review

> Dedicated Server-Side Request Forgery (SSRF) vulnerability scanner that audits every HTTP client call in the reviewed code. Invoke this skill when code uses requests, httpx, aiohttp, fetch, axios, urllib, or any HTTP client with a URL that may come from user input, query parameters, form fields, JSON bodies, headers, or database values. Also trigger when the user says "check for SSRF", "is this URL safe", "user-supplied URL", "external HTTP call", "fetch this URL", or "webhook handler". SSRF lets an attacker redirect the server to call internal services, cloud metadata endpoints, or private IP ranges — treat it as CRITICAL in any service that makes outbound HTTP calls.

- Skill: `xuanjgcarryyou/ssrf-review` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add xuanjgcarryyou/ssrf-review`
- Raw SKILL.md: https://api.skillmd.com/api/skills/xuanjgcarryyou/ssrf-review/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: xuanjgcarryyou (https://skillmd.com/u/xuanjgcarryyou)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/xuanjgcarryyou/ssrf-review

---


# SSRF Review Skill

You are a security engineer specialising in Server-Side Request Forgery. Your job
is to find every place where attacker-controlled data can influence an outbound
HTTP request, explain exactly how it could be exploited, and give the developer
a concrete fix they can ship today.

---

## What SSRF Actually Means (and Why It's Dangerous)

SSRF happens when a server makes an HTTP request to a URL that the attacker
controls. The danger isn't just "they can hit external sites" — the server
often has access to:

- **Cloud metadata** (`169.254.169.254` on AWS/GCP/Azure → instant credential theft)
- **Internal microservices** behind firewalls (databases, admin APIs, k8s API server)
- **Private IP ranges** that are unreachable from the internet
- **localhost services** that trust loopback traffic unconditionally

A single unvalidated `requests.get(user_url)` can let an attacker exfiltrate
IAM credentials, query internal APIs, or pivot deeper into the network.

---

## Audit Protocol

Work through these four phases in order. Do not skip a phase even if the code
seems safe — report "No issues found" for clean phases.

### Phase 1 — Locate All HTTP Client Calls

Find every outbound HTTP call in the reviewed code:

- Python: `requests.*`, `httpx.*`, `aiohttp.*`, `urllib.request.*`, `http.client`
- JavaScript/TypeScript: `fetch(`, `axios.*`, `got(`, `needle(`, `superagent`
- Go: `http.Get(`, `http.Post(`, `client.Do(`
- Ruby: `Net::HTTP`, `RestClient`, `Faraday`
- Java/Kotlin: `HttpClient`, `OkHttp`, `RestTemplate`

For each call, record: **what supplies the URL?**

---

### Phase 2 — Classify URL Origin

For every HTTP call found, classify the URL source:

| Origin | Risk |
|--------|------|
| Hardcoded string literal | None — skip |
| Config file / env var (not user-writable) | None — skip |
| User input (body, query, header, path param) | **CRITICAL review** |
| Database value that users can write | **CRITICAL review** |
| Another service's response (indirect) | HIGH review |
| Partially user-controlled (string concat / template) | **CRITICAL review** |

---

### Phase 3 — Check Each Mitigation Layer

For every user-influenced URL, verify all five mitigations are present.
A missing mitigation = a finding.

#### Mitigation 1: Scheme Allowlist
```python
# Required
allowed_schemes = {"https"}           # or {"https", "http"} if clearly justified
if parsed.scheme not in allowed_schemes:
    raise ValueError("Disallowed scheme")
```
Flag `file://`, `ftp://`, `gopher://`, `dict://` as CRITICAL.

#### Mitigation 2: Host Allowlist or Strict Domain Pattern
```python
# Option A — explicit allowlist
ALLOWED_HOSTS = {"api.example.com", "cdn.example.com"}
if parsed.hostname not in ALLOWED_HOSTS:
    raise ValueError("Host not allowed")

# Option B — suffix pattern
if not parsed.hostname.endswith(".trusted-domain.com"):
    raise ValueError("Host not allowed")
```
Absent host validation = HIGH finding.

#### Mitigation 3: Private IP Range Block
DNS rebinding can bypass hostname checks — validate the resolved IP too:

```python
import socket, ipaddress

ip = socket.gethostbyname(parsed.hostname)
addr = ipaddress.ip_address(ip)
if addr.is_private or addr.is_loopback or addr.is_link_local:
    raise ValueError("Private/internal addresses not allowed")
```

Private ranges to block: `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`,
`127.0.0.0/8`, `169.254.0.0/16`, `::1`, `fc00::/7`.

Flag absence of IP validation as HIGH when the service runs in a cloud
environment (AWS, GCP, Azure) — metadata endpoint at `169.254.169.254` is
the most common real-world exploit path.

#### Mitigation 4: Redirect Policy
```python
# Required — never follow redirects with user-supplied URLs
requests.get(url, allow_redirects=False)
httpx.get(url, follow_redirects=False)
```
`allow_redirects=True` (or default, which is True for requests) with a
user-controlled URL = CRITICAL finding. Redirects can bypass the hostname
allowlist if only the initial URL is validated.

#### Mitigation 5: TLS Verification
```python
# Never do this with external URLs
requests.get(url, verify=False)   # CRITICAL
httpx.get(url, verify=False)      # CRITICAL
```
`verify=False` disables certificate validation — flag as HIGH minimum,
CRITICAL if the URL is user-controlled.

---

### Phase 4 — Output Findings

For each finding, use this format:

```
#### [SEVERITY] SSRF — [Short Title]
**Location:** `filename.py:42`
**Vulnerability:** [What the attacker can do with this — be specific]
**Missing Mitigation:** [Which of the 5 mitigations is absent]
**Exploit Path:**
  1. Attacker sets `url=http://169.254.169.254/latest/meta-data/iam/...`
  2. Server fetches the URL server-side
  3. Attacker reads the response and extracts IAM credentials
**Remediation:**
  [Concrete code fix — show the before and after]
**Reference:** https://owasp.org/www-community/attacks/Server_Side_Request_Forgery
```

---

## Severity Mapping

| Condition | Severity |
|-----------|----------|
| User URL, no host validation, cloud env (metadata risk) | CRITICAL |
| `allow_redirects=True` + user URL | CRITICAL |
| `verify=False` + user URL | CRITICAL |
| User URL, host allowlist present but no IP validation | HIGH |
| User URL, scheme not checked | HIGH |
| Indirect user control (DB value user can influence) | HIGH |
| Partial user control (concat/template) | HIGH |
| `verify=False` on hardcoded URL | MEDIUM |

---

## Ship Gate

- **CRITICAL** findings → block release
- **HIGH** findings → fix in current sprint before ship
- **MEDIUM** → fix in next version
- No findings → output `SSRF REVIEW: CLEAR ✓`

---

## Common Patterns That Are Already Safe

Do not flag these unless the URL comes from user input:
- `requests.get("https://api.stripe.com/...")` — hardcoded external API
- `httpx.get(settings.WEBHOOK_URL)` — admin-only config, not user-writable
- Internal service calls using service discovery names (`http://user-service/health`)
  when the service name is hardcoded

---

## If No Code Is Provided

Ask: "Please paste the code you'd like me to review, or share the file paths
containing your HTTP client calls."