# SSRF filter bypass via parser gaps

Validator and fetcher parse the same URL differently; check normalization, host anchoring, IP forms, per-hop redirects

_Area: Web infrastructure and server-side requests. Seen in 16 disclosed reports; 13 confirmed bounties, median $1,000, range $100-$7,500; latest 2024-01-30. Updated 2026-10-23._

## How it works
An SSRF defense decides a destination is safe by matching the *text* of a URL or host against a denylist/allowlist. The HTTP client or resolver later parses that same text differently, or resolves it after the check. The assumption "the string I validated is the address I connect to" breaks when validator and fetcher disagree on authority parsing, IP representation, path handling, or when redirects change the target after validation [E4](https://bugbountylibrary.com/r/blog%3Ajub0bs-com-posts-2020-06-23-ssrf.md)[E5](https://bugbountylibrary.com/r/blog%3Aagarri-fr-blog-archives-2014-10-15-bypassing-blacklists-based-on-ipy-index-html.md)[E6](https://bugbountylibrary.com/r/h1%3A2301565.md)[E7](https://bugbountylibrary.com/r/h1%3A1702864.md)[E8](https://bugbountylibrary.com/r/h1%3A1565619.md).

## Where it shows up
- Unanchored host allowlist regexes like `/github\.com|.../` matching `github.com.evil.tld` [E2](https://bugbountylibrary.com/r/blog%3Ablog-tyage-net-posts-2021-06-27-dependabot-rce.md)
- URL validated by regex or prefix, then fetched by a client with different authority parsing (userinfo `@`) [E4](https://bugbountylibrary.com/r/blog%3Ajub0bs-com-posts-2020-06-23-ssrf.md)
- Naive prefix check instead of parsed-host check; `expected-host@attacker-host` relocates the real host [E4](https://bugbountylibrary.com/r/blog%3Ajub0bs-com-posts-2020-06-23-ssrf.md)
- Validator enforces a URL prefix while the fetcher also does local path resolution; a `//`-prefixed segment becomes an absolute path [E3](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-red-agent-pov-ssrf.md)
- Host whitelist bypassed by path confusion (`/proxy/attacker.com/trusted.com/`) and by an open redirect on a trusted domain [E1](https://bugbountylibrary.com/r/blog%3Ablog-geekycat-in-client-side-ssrf-to-google-cloud-project-takeover.md)
- IP denylist checking only one textual form: IPv4-mapped IPv6 (`::ffff:...`), octal, hex, zone IDs [E5](https://bugbountylibrary.com/r/blog%3Aagarri-fr-blog-archives-2014-10-15-bypassing-blacklists-based-on-ipy-index-html.md)[E6](https://bugbountylibrary.com/r/h1%3A2301565.md)
- Denylist gate conditioned on "input parses as an IP"; representations the parser rejects but the resolver accepts (Unicode enclosed digits, fullwidth dots) skip the range check [E7](https://bugbountylibrary.com/r/h1%3A1702864.md)
- Parser percent-decodes host but accepts decoded `/`, `@`, `?`, `#` that shift the host boundary [E8](https://bugbountylibrary.com/r/h1%3A1565619.md)
- Redirects followed after only the initial URL is validated [E6](https://bugbountylibrary.com/r/h1%3A2301565.md)

## How to review
The invariant: the exact address finally connected to must be the one validated, after full normalization, and re-checked on every redirect hop. Check that the validator and HTTP client are the same parser (or the client is fed the parsed result, not the raw string). Confirm allowlists are anchored and match the full host. Confirm IP checks run on the resolved address, cover IPv4-mapped IPv6 and alternate encodings, and that metadata endpoints are explicitly denied. Confirm redirects are disabled or re-validated per hop. Note: DNS rebinding/TOCTOU between check and connect is a real risk but is not demonstrated in these reports; treat it as a design concern, not evidenced here.

## Variants seen
- Unanchored allowlist regex [E2](https://bugbountylibrary.com/r/blog%3Ablog-tyage-net-posts-2021-06-27-dependabot-rce.md)
- Parser differential between validation regex and HTTP client authority [E4](https://bugbountylibrary.com/r/blog%3Ajub0bs-com-posts-2020-06-23-ssrf.md)
- Naive prefix check defeated by userinfo `@` [E4](https://bugbountylibrary.com/r/blog%3Ajub0bs-com-posts-2020-06-23-ssrf.md)
- Validator/fetcher path confusion: URL prefix check vs local absolute-path resolution (local file read, not network SSRF) [E3](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-red-agent-pov-ssrf.md)
- Host whitelist bypass via path confusion and trusted-domain open redirect [E1](https://bugbountylibrary.com/r/blog%3Ablog-geekycat-in-client-side-ssrf-to-google-cloud-project-takeover.md)
- Octal-encoded IP misclassified as PUBLIC by IPy while urllib2 resolves it to loopback [E5](https://bugbountylibrary.com/r/blog%3Aagarri-fr-blog-archives-2014-10-15-bypassing-blacklists-based-on-ipy-index-html.md)
- IPv4-mapped IPv6 bypassing banned-IP check [E6](https://bugbountylibrary.com/r/h1%3A2301565.md)
- Unicode/alternate-digit representation skipping the IP gate [E7](https://bugbountylibrary.com/r/h1%3A1702864.md)
- Percent-encoded separator shifting host boundary [E8](https://bugbountylibrary.com/r/h1%3A1565619.md)

## Impact and severity
Led to cloud credential and token theft, internal project and GKE node access, and secret API key leakage [E1](https://bugbountylibrary.com/r/blog%3Ablog-geekycat-in-client-side-ssrf-to-google-cloud-project-takeover.md)[E2](https://bugbountylibrary.com/r/blog%3Ablog-tyage-net-posts-2021-06-27-dependabot-rce.md)[E4](https://bugbountylibrary.com/r/blog%3Ajub0bs-com-posts-2020-06-23-ssrf.md)[E6](https://bugbountylibrary.com/r/h1%3A2301565.md)[E7](https://bugbountylibrary.com/r/h1%3A1702864.md). Severity rises with reachable metadata credentials, redirect-following, and pre-auth reachability. E1's headline RCE came from a separate shell-spawn flaw; only its SSRF half belongs to this pattern. E1's path-confusion is a whitelist logic flaw adjacent to, not strictly, a parser disagreement.

## Why fixes fail
E1's whitelist fix was bypassed a second time via a `*.google.com` open redirect, showing per-hop re-validation was still missing after the first patch [E1](https://bugbountylibrary.com/r/blog%3Ablog-geekycat-in-client-side-ssrf-to-google-cloud-project-takeover.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Ablog-geekycat-in-client-side-ssrf-to-google-cloud-project-takeover.md
- E2: https://bugbountylibrary.com/r/blog%3Ablog-tyage-net-posts-2021-06-27-dependabot-rce.md
- E3: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-red-agent-pov-ssrf.md
- E4: https://bugbountylibrary.com/r/blog%3Ajub0bs-com-posts-2020-06-23-ssrf.md
- E5: https://bugbountylibrary.com/r/blog%3Aagarri-fr-blog-archives-2014-10-15-bypassing-blacklists-based-on-ipy-index-html.md
- E6: https://bugbountylibrary.com/r/h1%3A2301565.md
- E7: https://bugbountylibrary.com/r/h1%3A1702864.md
- E8: https://bugbountylibrary.com/r/h1%3A1565619.md