Server-side URL fetch (unfurl / PDF / image / webhook)

Tags: ssrf, cloud, rce

Typical severity: P1-P3

What it becomes

Any feature that fetches a user-supplied URL is an SSRF gadget. Impact is where it can go (metadata, internal admin, file://).

Where to look

• unfurl

  Copy

• og:scraper

  Copy

• headless chrome

  Copy

• ImageMagick / LibreOffice

  Copy

• webhook delivery

  Copy

Chains

• Cloud metadata — 169.254.169.254 / metadata.google.internal / IMDS. Prefer a canary first.
• RCE — file://, gopher://, dict://, or a secondary parser bug in the fetcher (XXE, ImageTragick-class).
• XSS — The fetched content is inlined into HTML (stored XSS via SVG/HTML).

Notes

• Always use an OAST canary (interactsh / polygrid) before metadata. Blind SSRF is still a finding if you can hit an internal host.
• Redirects, DNS rebinding, and decimal IPs are bypass gadgets sitting on top of this one.