# SSRF via injected upstream config directives

Attacker input reaching git -c flags, X-Accel-Redirect, or decoded path segments that steer server-side fetches

_Area: Web infrastructure and server-side requests. Seen in 3 disclosed reports; 2 confirmed bounties: $500 and $3,000; latest 2021-02-11. Updated 2026-10-23._

## How it works
A server-side fetch is built by embedding attacker input into something the downstream component reads as configuration or control, not as plain data. The broken assumption: that the input only fills a value slot. When the input is placed inside a `-c key=value` CLI flag, a response header the front proxy honors, or a URL built from a decoded path segment, characters in the input can add new keys, headers, or query parameters. The fetch then goes where the attacker chose, not where the code intended.

## Where it shows up
- URLs concatenated into `git -c ...` config flags, where the URL can carry `.proxy=`-style keys [E1](https://bugbountylibrary.com/r/h1%3A855276.md)
- Reverse proxies that do not set `proxy_ignore_headers X-Accel-Redirect` (or X-Sendfile) while proxying to user-controlled backends [E2](https://bugbountylibrary.com/r/h1%3A1027873.md)
- Path segments that are URL-decoded before being joined into an outbound URL [E3](https://bugbountylibrary.com/r/h1%3A878779.md)

## How to review
Trace every server-side fetch to its source. The invariant: attacker input must occupy exactly one value position and must not be able to introduce a new key, header, or query parameter. For CLI config flags, confirm the URL is passed as a separate argument or escaped so `.proxy=`-style keys cannot form [E1](https://bugbountylibrary.com/r/h1%3A855276.md). For proxies, confirm `X-Accel-Redirect`/`X-Sendfile` from upstreams are ignored or stripped [E2](https://bugbountylibrary.com/r/h1%3A1027873.md). For URL building, confirm path segments are encoded, not decoded, before concatenation, and that no `?`/`&`/`=` can be smuggled [E3](https://bugbountylibrary.com/r/h1%3A878779.md).

## Variants seen
- Git config key injection through a crafted import URL overriding the intended `extraHeader` [E1](https://bugbountylibrary.com/r/h1%3A855276.md)
- Upstream-controlled `X-Accel-Redirect` dictating an internal NGINX redirect target; header-honoring, not config-flag injection [E2](https://bugbountylibrary.com/r/h1%3A1027873.md)
- URL-decoded hash injecting a `d` parameter into a gravatar fetch, chained through open redirects [E3](https://bugbountylibrary.com/r/h1%3A878779.md)

## Impact and severity
Led to SSRF reaching internal services: GitLab's internal Grafana was fully readable [E3](https://bugbountylibrary.com/r/h1%3A878779.md), and a git clone could be redirected through an internal proxy [E1](https://bugbountylibrary.com/r/h1%3A855276.md). E2 showed the header-honoring path was reachable but no internal route was actually hit [E2](https://bugbountylibrary.com/r/h1%3A1027873.md). Severity rises when the fetch can reach internal-only hosts or when redirect chains let the attacker pick the final destination [E3](https://bugbountylibrary.com/r/h1%3A878779.md).

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A855276.md
- E2: https://bugbountylibrary.com/r/h1%3A1027873.md
- E3: https://bugbountylibrary.com/r/h1%3A878779.md