Server-Side Request Forgery (SSRF)

Any server-side feature that takes a URL from the client — image proxies, webhook validators, PDF-from-URL exporters — can be pointed at internal-only services, turning the trusted server into the attacker's network proxy.

Cloud metadata endpoints (169.254.169.254) hand out IAM credentials to anything that can reach them from inside the VPC — a classic SSRF payload

Blocklisting hostnames is trivially bypassed with redirects, DNS rebinding, or alternate IP encodings (decimal, octal, IPv6-mapped)

An allowlist of destinations (not a blocklist of forbidden ones) is the only reliable control

Disabling HTTP redirect-following in the fetching library closes the most common bypass for an allowlist check

Want this flow explained in detail as it plays?

POST/api/import-avatar

Headers

Host:app.flowground.dev

Content-Type:application/json

Body

Stuck? Try a hint

Defense in depth

Revealed once you've worked through the hint ladder above — try the attack yourself first.

Vulnerable vs. Fixed

app.post("/api/import-avatar", async (req, res) => {
  const response = await fetch(req.body.imageUrl); // no validation at all
  const buffer = await response.arrayBuffer();
  res.send(buffer);
});