# SSRF via client-controlled proxy routing

Proxy builds backend host from cookies, paths or URLs and forwards its own trust or credentials

_Area: Web authentication and account takeover. Seen in 3 disclosed reports; latest 2025-02-12. Updated 2026-10-23._

## How it works
A proxy or fetch component is trusted to reach a fixed set of backends and to carry the caller's credentials or an implicit localhost trust. The assumption that breaks is that the destination host is fixed and validated. When the host is derived from client-controlled input — a routing cookie, a path segment, or a URI inside a signed document — the component sends the request, with whatever authority it holds, to a host the attacker chose, or reaches an internal service that trusts the proxy. The authority abused is often not a user credential but the proxy's own network position or the backend's trust in localhost [E1](https://bugbountylibrary.com/r/p0%3ACVE-2021-26855.md)[E2](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-ivantis-pulse-connect-secure-auth-bypass-round-two.md)[E3](https://bugbountylibrary.com/r/blog%3Adevco-re-blog-2021-08-06-a-new-attack-surface-on-ms-exchange-part-1-proxylogon.md).

## Where it shows up
- Proxy code that builds the backend URI from a cookie or path value [E1](https://bugbountylibrary.com/r/p0%3ACVE-2021-26855.md)[E3](https://bugbountylibrary.com/r/blog%3Adevco-re-blog-2021-08-06-a-new-attack-surface-on-ms-exchange-part-1-proxylogon.md).
- String concatenation into `UriBuilder`/`URL` where `@`, `#`, `:` shift the effective host [E1](https://bugbountylibrary.com/r/p0%3ACVE-2021-26855.md)[E3](https://bugbountylibrary.com/r/blog%3Adevco-re-blog-2021-08-06-a-new-attack-surface-on-ms-exchange-part-1-proxylogon.md).
- XML/SAML signature validation that dereferences `KeyInfo`/`RetrievalMethod` URIs [E2](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-ivantis-pulse-connect-secure-auth-bypass-round-two.md).
- Internal services on localhost that trust any local caller [E2](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-ivantis-pulse-connect-secure-auth-bypass-round-two.md).
- Frontend proxies that fail to strip routing headers before forwarding [E3](https://bugbountylibrary.com/r/blog%3Adevco-re-blog-2021-08-06-a-new-attack-surface-on-ms-exchange-part-1-proxylogon.md).
- Auth flows that take the identity-provider URL as a client parameter [E3](https://bugbountylibrary.com/r/blog%3Adevco-re-blog-2021-08-06-a-new-attack-surface-on-ms-exchange-part-1-proxylogon.md).

## How to review
The invariant: the destination host must be resolved from a server-side allowlist after full URL parsing, and authority must only be attached when the parsed host exactly matches an allowed entry. Check that the host comes from the parsed authority, not raw string splitting; that `@`, `#`, `:` and encoded forms cannot shift it; that routing headers are stripped at the frontend; and that XML/SAML parsers disable external entity and URI retrieval. For internal services, verify they authenticate callers rather than trusting localhost. For auth flows, confirm the IDP URL is checked against the configured list [E3](https://bugbountylibrary.com/r/blog%3Adevco-re-blog-2021-08-06-a-new-attack-surface-on-ms-exchange-part-1-proxylogon.md).

## Variants seen
- Routing cookie (`X-BEResource`) driving backend URI, unauthenticated [E1](https://bugbountylibrary.com/r/p0%3ACVE-2021-26855.md).
- SAML `RetrievalMethod` SSRF to a localhost REST service, chained to RCE [E2](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-ivantis-pulse-connect-secure-auth-bypass-round-two.md).
- `X-AnonResource-Backend` cookie plus unstripped routing header [E3](https://bugbountylibrary.com/r/blog%3Adevco-re-blog-2021-08-06-a-new-attack-surface-on-ms-exchange-part-1-proxylogon.md).
- Client-supplied OpenID provider URL trusted without allowlist check — adjacent trust-of-client-URL, not SSRF [E3](https://bugbountylibrary.com/r/blog%3Adevco-re-blog-2021-08-06-a-new-attack-surface-on-ms-exchange-part-1-proxylogon.md).

## Impact and severity
Ranged from pre-auth SSRF reaching internal endpoints as the server [E1](https://bugbountylibrary.com/r/p0%3ACVE-2021-26855.md) to auth bypass and RCE as SYSTEM/root [E2](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-ivantis-pulse-connect-secure-auth-bypass-round-two.md)[E3](https://bugbountylibrary.com/r/blog%3Adevco-re-blog-2021-08-06-a-new-attack-surface-on-ms-exchange-part-1-proxylogon.md). Severity rises when the proxy is unauthenticated, when internal services trust localhost, and when SSRF chains to file write or command injection.

## Evidence
- E1: https://bugbountylibrary.com/r/p0%3ACVE-2021-26855.md
- E2: https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-ivantis-pulse-connect-secure-auth-bypass-round-two.md
- E3: https://bugbountylibrary.com/r/blog%3Adevco-re-blog-2021-08-06-a-new-attack-surface-on-ms-exchange-part-1-proxylogon.md