SSRF
SSRF is a class of web security vulnerability in which an attacker manipulates the target server into issuing requests to internal network resources or sensitive interfaces on the attacker's behalf. It was designated as a standalone category, A10, in the OWASP Top 10 2021 list.
Core Facts
SSRF is a class of web security vulnerability in which an attacker manipulates a server-side application into making HTTP requests to unintended internal or external addresses.
Vulnerabilities such as SQL injection, XSS, and SSRF have long occupied the OWASP Top 10 security risk list.
Timeline (last 90 days)
The runtime proxy firewall's SSRF protection includes blocking internal URLs (such as localhost, 169.254.169.254, 10.x, 192.168.x), validating redirect chains (at most 3 hops, no protocol downgrade), preventing DNS rebinding, and extracting and validating embedded URLs through deep document inspection.
A single compromised MCP server can execute prompt injection, credential exfiltration, delivery of phishing toolkit fingerprints, PII leakage, token theft via OAuth, and SSRF attacks.
If LLM output is rendered or executed without encoding, it can lead to XSS (when rendered as HTML/Markdown), SQL injection (when concatenated into database queries), and SSRF (when URLs are included for backend fetching).
Blocklisting private addresses and metadata addresses by default is the most fundamental and critical step in defending against SSRF attacks, and developers implementing MCP tools with network access capabilities should refer to this approach as a priority.
mcp-server-fetch rejects private addresses, loopback addresses, and metadata addresses by default as an SSRF protection measure.
In agent browser automation scenarios, an SSRF variant threat exists where prompt injection can be used to induce the agent to access internal network addresses such as 169.254.169.254.
IPv6 offers multiple equivalent representations of the same address—for example, 127.0.0.1 can be written as ::1, ::ffff:127.0.0.1, or its fully expanded form—and if the protection logic only matches a string blacklist without normalized parsing, it can be bypassed.
The core change in langchain-core 1.6.8 compared to 1.6.7 is that SSRF checks for scoped and compatible IPv6 addresses were hardened via PR #41151.
In AI application frameworks such as LangChain, document loaders, web scraping tools, and agent toolchains that allow LLMs to autonomously invoke URLs are all potential SSRF entry points.
In traditional web applications, typical SSRF exploitation methods include accessing the AWS EC2 metadata service address 169.254.169.254 to steal temporary credentials for cloud instances.
9 more timeline events
All Facts (20)
SSRF is a class of web security vulnerability in which an attacker manipulates a server-side application into making HTTP requests to unintended internal or external addresses.
75%VerifiedVulnerabilities such as SQL injection, XSS, and SSRF have long occupied the OWASP Top 10 security risk list.
75%UnverifiedThe runtime proxy firewall's SSRF protection includes blocking internal URLs (such as localhost, 169.254.169.254, 10.x, 192.168.x), validating redirect chains (at most 3 hops, no protocol downgrade), preventing DNS rebinding, and extracting and validating embedded URLs through deep document inspection.
50%UnverifiedA single compromised MCP server can execute prompt injection, credential exfiltration, delivery of phishing toolkit fingerprints, PII leakage, token theft via OAuth, and SSRF attacks.
50%UnverifiedIf LLM output is rendered or executed without encoding, it can lead to XSS (when rendered as HTML/Markdown), SQL injection (when concatenated into database queries), and SSRF (when URLs are included for backend fetching).
50%UnverifiedBlocklisting private addresses and metadata addresses by default is the most fundamental and critical step in defending against SSRF attacks, and developers implementing MCP tools with network access capabilities should refer to this approach as a priority.
50%Unverifiedmcp-server-fetch rejects private addresses, loopback addresses, and metadata addresses by default as an SSRF protection measure.
50%UnverifiedIn agent browser automation scenarios, an SSRF variant threat exists where prompt injection can be used to induce the agent to access internal network addresses such as 169.254.169.254.
50%UnverifiedBy moving SSRF validation down to the langchain-core layer, all upper-layer applications that depend on this core library can automatically receive protection without each needing to implement it independently.
50%UnverifiedThe core change in langchain-core 1.6.8 compared to 1.6.7 is that SSRF checks for scoped and compatible IPv6 addresses were hardened via PR #41151.
50%UnverifiedIPv6 offers multiple equivalent representations of the same address—for example, 127.0.0.1 can be written as ::1, ::ffff:127.0.0.1, or its fully expanded form—and if the protection logic only matches a string blacklist without normalized parsing, it can be bypassed.
50%UnverifiedIn AI application frameworks such as LangChain, document loaders, web scraping tools, and agent toolchains that allow LLMs to autonomously invoke URLs are all potential SSRF entry points.
50%UnverifiedIn traditional web applications, typical SSRF exploitation methods include accessing the AWS EC2 metadata service address 169.254.169.254 to steal temporary credentials for cloud instances.
50%UnverifiedSSRF利用中常被检测的危险协议包括file://（读取本地文件）、dict://（探测端口开放状态）、ftp://（有时可绕过过滤）
50%Unverified防御SSRF需对用户可控的URL做协议白名单、禁止访问内网地址、过滤file://等危险协议
50%UnverifiedSSRF漏洞在OWASP Top 10 2021版中被单独列为一类（A10）
50%UnverifiedAegotrax v0.2.4 adds SSRF/IMDS protection at both the engine and gateway layers.
50%UnverifiedThe most dangerous target of SSRF (Server-Side Request Forgery) in cloud environments is the IMDS instance metadata service, with AWS's IMDS address being 169.254.169.254.
50%UnverifiedNetworking capabilities such as WebFetch introduce security risks including prompt injection, SSRF, and sensitive data leakage.
50%Unverified在演示中，豆包按照提示词执行后不仅确认了URL预览功能存在SSRF漏洞，还验证出任意文件读取问题
50%