Server-Side Vulnerabilities

SSRF is the server fetching a client-controlled URL, so the request leaves from inside the network and reaches internal services. A denylist of internal addresses is never complete; an allowlist of hosts and ports denies the rest.

Both come from the request, so the client sets them freely and any content can be declared an image. The server derives the type from the bytes, stores the file outside the web root under a generated name and serves it without execution.

A document can declare an entity whose value is a URI, and a parser with external entity resolution enabled fetches it, so parsing reads local files or issues requests from the server. Fix it in the parser by disabling those definitions.

A native deserializer rebuilds whatever types the bytes name, so untrusted input decides which classes are created and which callbacks run — execution, not parsing. The safe default is a data-only format parsed into declared types.

The metadata service answers unauthenticated requests from the instance and can return the attached role credentials, so one server-side fetch becomes cloud access. IMDSv2 requires a token taken by PUT and a low hop limit.

The binder writes every field it finds in the body onto the target type, so attributes the client should never own — role, owner id, balance — are set whenever the request mentions them. Bind into an input model with only the editable fields.

Joining the received name onto the storage path lets relative segments walk out of the directory, so the write lands where the name points. Fix it by generating the stored name server-side, or by rejecting a resolved path outside the base directory.

Validation resolves the hostname and approves the address, then the fetch resolves it again and gets a different one — a time-of-check to time-of-use gap. Close it by resolving once, validating that address and connecting to it.

Nothing shows in the response, so look at what the server emits: resolver queries, outbound connection records and proxy logs reveal destinations no feature should reach. Contain it with an egress proxy that allowlists destinations and drops redirects.

An input that changes the response but is not part of the cache key lets one request store an entry that every later client receives. Keep key and response inputs aligned — include the header in the key or strip it at the edge.

Host arrives in the request, so the client chooses it. An application composing absolute links from it can send a password-reset URL pointing elsewhere, and a cache may store that response. Take the public origin from configuration instead.

Two servers reusing one connection disagree on where a request ends, because one trusts Content-Length and the other Transfer-Encoding, so leftover bytes start the next request. The fix is consistent framing and rejecting ambiguous headers.

Three trust defects. The declared content type is client-set, so detect the type from the bytes. The received filename is joined onto the storage path, so generate the stored name. The directory sits in the web root, so move it out and serve without execution.

Move the envelope to a data-only format parsed into a declared input model with a fixed field set, rejecting unknown types. Verify the message signature before parsing and authorize the job in the consumer after it. Cut over when the native reader records zero calls.