# SSRF via unvalidated fetch URL parameter

User input reaching a server-side fetch URL without allowlist; check every URL field, not just the obvious one

_Area: Web infrastructure and server-side requests. Seen in 5 disclosed reports; one confirmed bounty: $17,576; latest 2026-07-30. Updated 2026-10-25._

## How it works
A server-side request is built from user input — a path segment, query value, or whole URL — and fetched without checking where it goes. The broken assumption is that the input is a benign identifier or format hint. It is actually a URL fragment, so the attacker controls the destination host, path, or query of an outbound request made from inside the trust boundary.

## Where it shows up
- Request params concatenated into a fetch URL: `file_id`, `ig`, `callback_url`, `webSiteRootURL`, `file_type` [E1](https://bugbountylibrary.com/r/blog%3Ahttpvoid-com-hacking-google-drive-integrations-md.md)[E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-vr79-8m62-wh98.md)[E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-jx74-cqjv-2c67.md)[E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-5f7v-4f6g-74rj.md)[E5](https://bugbountylibrary.com/r/ghsa%3AGHSA-jvxv-2jjp-jxc3.md)
- Fallback to `$_REQUEST`/client value when config is missing [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-5f7v-4f6g-74rj.md)
- Secondary URL fields (callback/webhook) skipping the allowlist that guards the primary field [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-jx74-cqjv-2c67.md)
- String interpolation into an upstream service URL without encoding, where the upstream supports a proxy/fetch param [E5](https://bugbountylibrary.com/r/ghsa%3AGHSA-jvxv-2jjp-jxc3.md)
- Credential matching by `startsWith()`/`contains()` on full URLs [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-vr79-8m62-wh98.md)
- Internal auth headers attached unconditionally to outbound calls [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-jx74-cqjv-2c67.md)

## How to review
Trace every user-controlled value into the fetch call. The invariant: the final resolved URL's scheme and host must be checked against an explicit allowlist after normalization, and no user input may alter host or add query params. Check each URL field independently — a guarded `target_url` does not protect `callback_url` [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-jx74-cqjv-2c67.md). For credential providers, match on parsed host equality, not prefix [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-vr79-8m62-wh98.md). For upstream proxies, confirm user fragments are encoded and cannot inject params like `proxy=` [E5](https://bugbountylibrary.com/r/ghsa%3AGHSA-jvxv-2jjp-jxc3.md). Confirm internal secrets are not attached to requests to unvalidated destinations [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-jx74-cqjv-2c67.md).

## Variants seen
- Path traversal plus query injection into a cloud API URL, with `alt=media` returning attacker JSON that supplies the next URL [E1](https://bugbountylibrary.com/r/blog%3Ahttpvoid-com-hacking-google-drive-integrations-md.md)
- Unauthenticated endpoint passing user URL straight to a loader, plus prefix-match credential leak [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-vr79-8m62-wh98.md)
- Callback URL used verbatim with internal key attached [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-jx74-cqjv-2c67.md)
- Request-supplied base URL used for service-to-service token verification, enabling auth bypass [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-5f7v-4f6g-74rj.md)
- Query param interpolated unencoded into an internal image service URL [E5](https://bugbountylibrary.com/r/ghsa%3AGHSA-jvxv-2jjp-jxc3.md)

## Impact and severity
Reached internal hosts, leaked Bearer/Basic tokens and runner secrets, and forged verification responses leading to auth bypass [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-vr79-8m62-wh98.md)[E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-jx74-cqjv-2c67.md)[E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-5f7v-4f6g-74rj.md). Severity rises when the endpoint is unauthenticated and when internal credentials ride along on the request.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Ahttpvoid-com-hacking-google-drive-integrations-md.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-vr79-8m62-wh98.md
- E3: https://bugbountylibrary.com/r/ghsa%3AGHSA-jx74-cqjv-2c67.md
- E4: https://bugbountylibrary.com/r/ghsa%3AGHSA-5f7v-4f6g-74rj.md
- E5: https://bugbountylibrary.com/r/ghsa%3AGHSA-jvxv-2jjp-jxc3.md