# Unvalidated URL SSRF to internal services

Server-side fetch of user-supplied URL with no host allowlist, reaching loopback or internal APIs

_Area: Web infrastructure and server-side requests. Seen in 5 disclosed reports; latest 2026-10-27. Updated 2026-11-01._

## How it works
A server accepts a URL (or host, or path) from the request and fetches it itself. The code assumes the URL points at a benign external resource, but the fetcher runs with the server's own network position and trust. So the attacker's URL can name loopback, link-local, cloud metadata, or a sibling internal app that only trusts localhost. The broken assumption: "the URL is data, not a request." In practice the URL is a request the server makes on the attacker's behalf, carrying the server's identity and any credentials the fetcher attaches.

## Where it shows up
- Any request field holding a URL, host, image/audio source, or import/load target that the server later fetches.
- HTTP clients built without a redirect policy, so attacker redirects extend reach [E2](https://bugbountylibrary.com/r/h1%3A809248.md).
- Internal services gated by a client-IP allowlist that includes localhost by default [E1](https://bugbountylibrary.com/r/blog%3Athezdi-com-blog-2026-10-20-cve-2026-35273-ssrf-to-rce-in-oracle-peoplesoft.md)[E5](https://bugbountylibrary.com/r/blog%3Azerodayinitiative-com-blog-2026-10-20-cve-2026-35273-ssrf-to-rce-in-oracle-peoplesoft.md).
- Credential providers matching configured server URLs with `startsWith()`/`contains()` on full URLs [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-vr79-8m62-wh98.md).
- Parsers that fall back to treating a bare string as a local file path, or accept `file://` [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-wfgq-w7cq-qj7j.md).
- Clients that trust a daemon/agent the tenant controls, including its TLS keys [E2](https://bugbountylibrary.com/r/h1%3A809248.md).

## How to review
Trace every user-controlled URL to the actual fetch call. The invariant: before any outbound request, the resolved destination must be checked against an explicit allowlist of hosts/schemes, after DNS resolution and on every redirect hop, and local/private/link-local/metadata ranges must be refused. Check that redirects are either disabled or re-validated per hop [E2](https://bugbountylibrary.com/r/h1%3A809248.md)[E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-vr79-8m62-wh98.md)[E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-wfgq-w7cq-qj7j.md). Check that a bare string cannot silently become a local file open [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-wfgq-w7cq-qj7j.md). For internal services, confirm the access gate does not treat localhost as trusted by default [E1](https://bugbountylibrary.com/r/blog%3Athezdi-com-blog-2026-10-20-cve-2026-35273-ssrf-to-rce-in-oracle-peoplesoft.md)[E5](https://bugbountylibrary.com/r/blog%3Azerodayinitiative-com-blog-2026-10-20-cve-2026-35273-ssrf-to-rce-in-oracle-peoplesoft.md). For credential matching, confirm exact host comparison, not prefix matching [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-vr79-8m62-wh98.md).

## How finders spotted it
- Read the allowlist logic, saw localhost trusted by default, then found a sibling app forwarding unvalidated URLs and bodies — the SSRF satisfies the check [E1](https://bugbountylibrary.com/r/blog%3Athezdi-com-blog-2026-10-20-cve-2026-35273-ssrf-to-rce-in-oracle-peoplesoft.md)[E5](https://bugbountylibrary.com/r/blog%3Azerodayinitiative-com-blog-2026-10-20-cve-2026-35273-ssrf-to-rce-in-oracle-peoplesoft.md).
- Code review spotted `http.Client{Transport: transport}` with no redirect policy, and reasoned the tenant-controlled daemon can supply redirects [E2](https://bugbountylibrary.com/r/h1%3A809248.md).
- Traced the `/loadIG` handler's unvalidated value into the loader, then saw `startsWith()` prefix matching in the credential provider [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-vr79-8m62-wh98.md).
- Noticed a fallback treating any parseable-as-existing path as a file URL, plus an unguarded fetch, then compared error paths to build an oracle [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-wfgq-w7cq-qj7j.md).

## Variants seen
- SSRF into a loopback-only internal service, escalating to file write and deserialization RCE [E1](https://bugbountylibrary.com/r/blog%3Athezdi-com-blog-2026-10-20-cve-2026-35273-ssrf-to-rce-in-oracle-peoplesoft.md)[E5](https://bugbountylibrary.com/r/blog%3Azerodayinitiative-com-blog-2026-10-20-cve-2026-35273-ssrf-to-rce-in-oracle-peoplesoft.md).
- Redirect-following client pivoting to metadata services [E2](https://bugbountylibrary.com/r/h1%3A809248.md)[E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-wfgq-w7cq-qj7j.md).
- Prefix-matched credentials leaked to attacker domains [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-vr79-8m62-wh98.md).
- Local file read and existence oracle via path fallback [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-wfgq-w7cq-qj7j.md).

## Impact and severity
Reached RCE via file write and XMLDecoder deserialization [E1](https://bugbountylibrary.com/r/blog%3Athezdi-com-blog-2026-10-20-cve-2026-35273-ssrf-to-rce-in-oracle-peoplesoft.md)[E5](https://bugbountylibrary.com/r/blog%3Azerodayinitiative-com-blog-2026-10-20-cve-2026-35273-ssrf-to-rce-in-oracle-peoplesoft.md), metadata token theft [E2](https://bugbountylibrary.com/r/h1%3A809248.md), credential theft enabling supply-chain and clinical-endpoint access (scope change) [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-vr79-8m62-wh98.md), and unauthenticated file read/enumeration [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-wfgq-w7cq-qj7j.md). Impact rose when chained with a localhost-trusting gate [E1](https://bugbountylibrary.com/r/blog%3Athezdi-com-blog-2026-10-20-cve-2026-35273-ssrf-to-rce-in-oracle-peoplesoft.md)[E5](https://bugbountylibrary.com/r/blog%3Azerodayinitiative-com-blog-2026-10-20-cve-2026-35273-ssrf-to-rce-in-oracle-peoplesoft.md) or credential matching [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-vr79-8m62-wh98.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Athezdi-com-blog-2026-10-20-cve-2026-35273-ssrf-to-rce-in-oracle-peoplesoft.md
- E2: https://bugbountylibrary.com/r/h1%3A809248.md
- E3: https://bugbountylibrary.com/r/ghsa%3AGHSA-vr79-8m62-wh98.md
- E4: https://bugbountylibrary.com/r/ghsa%3AGHSA-wfgq-w7cq-qj7j.md
- E5: https://bugbountylibrary.com/r/blog%3Azerodayinitiative-com-blog-2026-10-20-cve-2026-35273-ssrf-to-rce-in-oracle-peoplesoft.md