# SSRF via header and path override

Proxy or fetcher builds target URL from headers, pathname or file id without a host allowlist

_Area: Web infrastructure and server-side requests. Seen in 3 disclosed reports; one confirmed bounty: $17,576; latest 2023-12-27. Updated 2026-11-02._

## How it works
A server-side fetcher assembles the URL it will request from pieces the user controls: a pathname, a forwarded header, or an ID placed into an upstream API path. The code assumes those pieces are relative or benign, so it never re-checks the final host. When the piece is actually an authority (`//host`, `http://host`), a protocol value, or a traversable path segment, the request goes wherever the attacker points it — internal hosts, cloud metadata, or an attacker-chosen origin [E1](https://bugbountylibrary.com/r/blog%3Ahttpvoid-com-hacking-google-drive-integrations-md.md)[E2](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-exploiting-static-site-generators-when-static-is-not-actually-static.md)[E3](https://bugbountylibrary.com/r/h1%3A1663788.md).

## Where it shows up
- HTTP client calls that concatenate a base origin with a user-supplied path (`request(origin + pathname)`) [E3](https://bugbountylibrary.com/r/h1%3A1663788.md)
- Image proxies/optimizers (`/_ipx/`, Gatsby image routes) that build fetch URLs from `x-forwarded-proto` or `host` [E2](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-exploiting-static-site-generators-when-static-is-not-actually-static.md)
- Cloud-storage integrations that put a user `file_id` into an upstream API URL path [E1](https://bugbountylibrary.com/r/blog%3Ahttpvoid-com-hacking-google-drive-integrations-md.md)
- Whitelist/validation logic that lives in only one branch of an `if` (e.g. `isLocal` short-circuit) [E2](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-exploiting-static-site-generators-when-static-is-not-actually-static.md)
- Server-side parsing of a fetched file's JSON to find a `downloadUrl` that is then fetched [E1](https://bugbountylibrary.com/r/blog%3Ahttpvoid-com-hacking-google-drive-integrations-md.md)

## How to review
Find every place a URL is built from user input and ask: can the user-supplied part change the authority (host/port/scheme)? The invariant: after construction, parse the URL and confirm scheme and host match an explicit allowlist; reject protocol-relative (`//`), absolute (`scheme://`), and path-traversal segments before the request. For header-derived values, treat `x-forwarded-proto`/`host` as untrusted and never let them select the fetch target. For ID-in-path patterns, confirm the ID is URL-encoded and cannot inject `?`, `#`, or `../` [E1](https://bugbountylibrary.com/r/blog%3Ahttpvoid-com-hacking-google-drive-integrations-md.md). Check that validation runs on every branch, not just the non-local one [E2](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-exploiting-static-site-generators-when-static-is-not-actually-static.md).

## How finders spotted it
- Noticed `file_id` concatenated into the Google API URL path, hypothesized path traversal plus query injection, then recalled `alt=media` returns raw bytes so the parsed JSON (and its `downloadUrl`) was attacker-controlled [E1](https://bugbountylibrary.com/r/blog%3Ahttpvoid-com-hacking-google-drive-integrations-md.md)
- Sam Curry noticed image-pull/optimize behavior on a Netlify+Next.js site, prompting source review of `@netlify/ipx`; auditors saw the URL used user-controlled `x-forwarded-proto` and that the whitelist lived only in the `else` branch skipped when `isLocal` is true [E2](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-exploiting-static-site-generators-when-static-is-not-actually-static.md)
- Habit: when a client merges a base origin with a user path, test protocol-relative and absolute path values — URL parsers treat these as authority overrides [E3](https://bugbountylibrary.com/r/h1%3A1663788.md)

## Variants seen
- Path traversal + query injection into an upstream API path, with `alt=media` to control parsed JSON [E1](https://bugbountylibrary.com/r/blog%3Ahttpvoid-com-hacking-google-drive-integrations-md.md)
- Header-derived scheme (`x-forwarded-proto`) skipping a host whitelist branch [E2](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-exploiting-static-site-generators-when-static-is-not-actually-static.md)
- Protocol-relative/absolute pathname overriding the origin in an HTTP client [E3](https://bugbountylibrary.com/r/h1%3A1663788.md)

## Impact and severity
E1 reached internal hosts and exfiltrated response bodies via a forced Java exception. E2 escalated to persistent XSS across Next.js sites on Netlify because the plugin auto-registers `/_ipx/*` on every site, scaling to hundreds of thousands of sites. E3 allowed requests to arbitrary hosts including `127.0.0.1`. Impact rises with default-on routing [E2](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-exploiting-static-site-generators-when-static-is-not-actually-static.md) and with the ability to chain a second weakness (JSON trust, CRLF) [E1](https://bugbountylibrary.com/r/blog%3Ahttpvoid-com-hacking-google-drive-integrations-md.md).

## Seen in real software
Open-source packages and projects, and products, where this pattern was found. If the target runs one, compare the version it runs with the fix.
- **Netlify IPX** (image optimizer handler (/_ipx/)) (version not stated): Exploiting Static Site Generators: When Static Is Not Actually Static. Report: https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-exploiting-static-site-generators-when-static-is-not-actually-static.md
- **Node.js**: [CVE-2022-35949]: undici.request vulnerable to SSRF using absolute / protocol-relative URL on pathname (CVE-2022-35949). Report: https://bugbountylibrary.com/r/h1%3A1663788.md

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Ahttpvoid-com-hacking-google-drive-integrations-md.md
- E2: https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-exploiting-static-site-generators-when-static-is-not-actually-static.md
- E3: https://bugbountylibrary.com/r/h1%3A1663788.md