服务端请求伪造

让服务器替你发请求。云环境里一次 SSRF 往往意味着元数据凭据泄露。

影响

访问内网服务与云元数据接口，获取临时凭据并横向移动

观察点

服务器向攻击者控制的地址或内网地址发起了请求

修复

对出站请求使用白名单，解析后再次校验 IP，禁止访问内网与元数据地址，并启用 IMDSv2。

弱点分布

• SSRF293
• Server Side Request Forgery1

共现类别

暂无共现数据。

高票报告

当前状态 294 份 · 全部 294 · 筛选赏金 $169,546

1. 587
   SSRF in Exchange leads to ROOT access in all instancesShopify · 2018-05-24 · 中危
   $0SSRF
2. 529
   Server Side Request Forgery (SSRF) via Analytics ReportsHackerOne · 2023-12-09 · 严重
   $25,000SSRF
3. 421
   Server-Side Request Forgery using Javascript allows to exfill data from Google MetadataSnapchat · 2020-12-01 · 未评级
   $0SSRF
4. 360
   Server Side Request Forgery (SSRF) at app.hellosign.com leads to AWS private keys disclosureDropbox · — · 未评级
   $4,913SSRF
5. 359
   SSRF on project import via the remote_attachment_url on a NoteGitLab · 2020-06-08 · 高危
   $10,000SSRF
6. 350
   Server Side Request Forgery mitigation bypassGitLab · 2020-04-18 · 高危
   $0SSRF
7. 344
   Blind SSRF to internal services in matrix preview_link APIReddit · 2023-04-26 · 高危
   $6,000SSRF
8. 323
   TURN server allows TCP and UDP proxying to internal network, localhost and meta-data servicesSlack · 2020-03-12 · 严重
   $3,500SSRF
9. 302
   Full Response SSRF via Google DriveDropbox · — · 未评级
   $17,576SSRF
10. 276
    SSRF leaking internal google cloud data through upload function [SSH Keys, etc..]Vimeo · 2019-12-14 · 严重
    $0SSRF
11. 272
    SSRF on fleet.city-mobil.ru leads to local file readMail.ru · — · 未评级
    $0SSRF
12. 264
    Full read SSRF in www.evernote.com that can leak aws metadata and local file inclusionEvernote · 2021-12-07 · 严重
    $0SSRF
13. 261
    SSRF in graphQL query (pwapi.ex2b.com)EXNESS · 2023-07-25 · 中危
    $3,000SSRF
14. 238
    Unauthenticated blind SSRF in OAuth Jira authorization controllerGitLab · 2019-03-15 · 高危
    $4,000SSRF
15. 237
    SSRF & LFR on city-mobil.ruMail.ru · — · 未评级
    $0SSRF
16. 229
    Full Read SSRF on Gitlab's Internal GrafanaGitLab · 2020-08-07 · 严重
    $0SSRF
17. 214
    SSRF in webhooks leads to AWS private keys disclosureOmise · 2019-06-28 · 高危
    $0SSRF
18. 178
    Stored XSS & SSRF in Lark DocsLark Technologies · 2021-02-06 · 严重
    $3,000SSRF
19. 165
    SSRF on duckduckgo.com/iu/DuckDuckGo · 2018-09-10 · 高危
    $0SSRF
20. 164
    Server Side Request ForgeryLark Technologies · 2021-03-29 · 严重
    $0SSRF
21. 162
    External SSRF and Local File Read via video upload due to vulnerable FFmpeg HLS processingTikTok · 2021-02-16 · 高危
    $2,727SSRF
22. 161
    SSRF in Autodesk Rendering leading to account takeoverAutodesk · 2025-03-19 · 严重
    $0SSRF
23. 148
    SSRF chained to hit internal host leading to another SSRF which allows to read internal images.PlayStation · 2021-03-30 · 高危
    $1,000SSRF
24. 144
    DNS Rebinding SSRF in Burp Suite MCP Server Enables Internal Network Access via send_http1_request ToolPortSwigger Web Security · 2025-10-08 · 低危
    $0SSRF
25. 143
    Blind SSRF on errors.hackerone.net due to Sentry misconfigurationHackerOne · 2018-07-04 · 低危
    $3,500SSRF