Server-Side Request Forgery

Server-Side Request Forgery lets an attacker make the server issue HTTP requests to destinations of their choosing — internal services not exposed to the internet, cloud metadata endpoints (169.254.169.254), or loopback addresses. In cloud environments, reaching the metadata service often yields IAM credentials that escalate to full account takeover.

SSRF is particularly hard to catch in review because the vulnerability is often in the validation logic rather than the fetch call. An allow-list check that uses string prefix matching can be bypassed with URL redirects, IPv6 representations, percent-encoding, or DNS rebinding. The ip package SSRF (CVE-2024-29415) exploited exactly this: an IP canonicalization library gave incorrect "private" verdicts for some IPv6 representations of private ranges.

PullLight looks for server-side HTTP calls where the URL is directly or indirectly user-controlled, examines the validation code before the call for bypass-able allow/block list patterns, and flags WebSocket upgrade handlers and proxy endpoints — both common SSRF vectors that are easy to overlook in PRs.