Your application fetches a URL. The user supplied it. Your server makes the request, follows the redirect, and returns the content.
The URL pointed to http://169.254.169.254/latest/metadata/iam/security-credentials/production-role.
Your application just handed the attacker your cloud credentials.
TL;DR
- SSRF lets an attacker trick your server into making requests on their behalf — to internal services, cloud metadata endpoints, or infrastructure never meant to be reachable from the outside.
- CVE-2024-29415 in the npm
ippackage allowed attackers to bypass SSRF protections using non-standard IP representations thatisPublic()incorrectly classified as safe. CVSS 8.1 High. - Your suite almost certainly validates that your URL-fetchin feature works. It does not validate that it refuses to fetch
http://169.254.169.254/latest/meta-data/orhttp://127.1/admin. - Fix requires an allowlist of permitted destinations, not a blocklist. Blocklists fail because IP representations are infinite. Allowlists fail only if you misconfigure them.
- AI-generated tests submit valid URLs and assert correct responses. They never submit internal service addresses. The SSRF surface stays untouched.
What it is
Server-Side Request Forgery (CWE-918, OWASP A10:2021) occurs when an application fetches a remote resource based on a URL supplied by the user without sufficiently validating that the destination is permitted.
The server makes the request with its own credentials and network position. In cloud environments, this means access to the instance metadata service, internal VPC services, Kubernetes API servers, Redis instances — any resource reachable from the server's network context but not from the public internet.
The attacker's HTTP request never touches those services directly. The server makes the request for them.
Developers introduce SSRF when building legitimately useful features: URL preview generation, webhook delivery, import from external URLs, image fetching from user-supplied sources. A developer adds a check to ensure the target is not a private IP address. The check uses a library function. The library function has edge cases the developer never tested. The feature ships, all happy-path tests pass, and the SSRF surface exists silently in production.
What makes SSRF particularly dangerous in cloud and microservices environments is the blast radius. A single vulnerability in one service can expose credentials for the entire cloud account, enable lateral movement to internal APIs, allow enumeration of the internal network topology, and provide an unauthenticated entry point to services that assume they are only reachable from trusted internal callers.
Real world damage
CVE-2024-29415 · npm ip package · May 2024 · CVSS 8.1 (High)
In May 2024, an SSRF vulnerability was published for the ip npm package — a widely used Node.js library for IP address manipulation and validation. The isPublic() function, intended to identify whether an IP address is globally routable, incorrectly classified several non-standard representations as public when they actually resolved to loopback or private addresses.
Representations including 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1 all passed the isPublic() check — meaning applications relying on this function to block SSRF requests would silently allow connections to localhost and private network services.
Source: GitHub Advisory GHSA-2p57-rm9w-gvfp and NVD CVE-2024-29415 (nvd.nist.gov/vuln/detail/CVE-2024-29415). Affected versions:
ipthrough 2.0.1.
In a cloud environment, a request to http://127.1/latest/meta data/ on an AWS EC2 instance routes to the same metadata service as http://169.254.169.254/latest/meta-data/ — potentially exposing IAM credentials. A QA engineer running SSRF payload tests with non-standard IP representations would have caught this. No such tests existed in the pipelines of applications that trusted the ip package for SSRF protection.
The invisible bug problem
Test suites for URL-fetching features test that the feature fetches URLs correctly. They submit a valid external URL, assert a 200 response, and check that content was returned as expected.
Nobody submits http://127.0.0.1/admin, http://169.254.169.254/latest/meta-data/, or http://127.1/config.
The SSRF protection layer is never exercised because all test inputs are exactly what the protection was never designed to reject. The happy path never touches the validation logic from the adversarial direction.
SSRF lives entirely in the space between "what valid input looks like" and "what an attacker would actually submit" — and that space is never covered by tests written by someone thinking about how the feature works rather than how it breaks.
How QA engineers catch it
The core principle: every endpoint that accepts a URL, hostname, or IP address from user input must be tested with a systematic list of SSRF payloads targeting internal and cloud metadata addresses. Not just valid external URLs. Specifically adversarial inputs designed to reach private infrastructure.
SSRF payload reference
# Cloud metadata endpoints
http://169.254.169.254/latest/meta-data/ # AWS
http://169.254.169.254/latest/meta-data/iam/security-credentials/
http://metadata.google.internal/computeMetadata/v1/ # GCP
http://169.254.169.254/metadata/instance # Azure
# Localhost variants
http://127.0.0.1/
http://localhost/
http://0.0.0.0/
# Non-standard representations — bypass naive isPublic() checks
http://127.1/ # CVE-2024-29415 bypass
http://0x7f000001/ # hexadecimal
http://2130706433/ # decimal
http://012.0.0.1/ # octal
# Internal network ranges
http://192.168.1.1/
http://10.0.0.1/
http://172.16.0.1/
PyTest
import pytest
import requests
BASE_URL = "https://your-app.com"
SSRF_PAYLOADS = [
# cloud metadata
"http://169.254.169.254/latest/meta-data/",
"http://169.254.169.254/latest/meta-data/iam/security-credentials/",
"http://metadata.google.internal/computeMetadata/v1/",
"http://169.254.169.254/metadata/instance",
# localhost variants
"http://127.0.0.1/",
"http://localhost/",
"http://0.0.0.0/",
# CVE-2024-29415 bypass patterns — non-standard representations
"http://127.1/",
"http://0x7f000001/",
"http://2130706433/",
"http://012.0.0.1/",
# internal network ranges
"http://192.168.1.1/",
"http://10.0.0.1/",
"http://172.16.0.1/",
]
METADATA_MARKERS = [
"ami-id", "instance-id", "computeMetadata",
"access_key", "secret_access_key", "security-credentials"
]
@pytest.fixture
def auth_session():
session = requests.Session()
session.post(f"{BASE_URL}/login", json={
"username": "testuser",
"password": "test_password"
})
return session
@pytest.mark.parametrize("payload", SSRF_PAYLOADS)
def test_ssrf_payload_rejected(auth_session, payload):
# every internal/cloud address must be rejected — never 200
response = auth_session.post(
f"{BASE_URL}/api/fetch-url",
json={"url": payload}
)
assert response.status_code in [400, 403, 422], (
f"SSRF payload not rejected: {payload} "
f"returned {response.status_code}"
)
@pytest.mark.parametrize("payload", SSRF_PAYLOADS)
def test_ssrf_no_internal_content_in_response(auth_session, payload):
# even if rejected with wrong status, body must not contain metadata
response = auth_session.post(
f"{BASE_URL}/api/fetch-url",
json={"url": payload}
)
body = response.text
for marker in METADATA_MARKERS:
assert marker not in body, (
f"Internal service content '{marker}' found in response "
f"for payload: {payload}"
)
def test_ssrf_non_standard_ip_representations(auth_session):
# CVE-2024-29415: isPublic() bypass via non-standard IP formats
bypass_payloads = [
"http://127.1/",
"http://0x7f000001/",
"http://2130706433/",
"http://012.0.0.1/",
]
for payload in bypass_payloads:
response = auth_session.post(
f"{BASE_URL}/api/fetch-url",
json={"url": payload}
)
assert response.status_code in [400, 403, 422], (
f"Non-standard IP bypass not blocked: {payload}"
)
def test_ssrf_valid_external_url_still_works(auth_session):
# confirm SSRF protection does not break legitimate requests
response = auth_session.post(
f"{BASE_URL}/api/fetch-url",
json={"url": "https://httpbin.org/get"}
)
assert response.status_code == 200
Robot Framework
*** Settings ***
Library RequestsLibrary
Library Collections
*** Variables ***
${BASE_URL} https://your-app.com
@{CLOUD_METADATA}
... http://169.254.169.254/latest/meta-data/
... http://169.254.169.254/latest/meta-data/iam/security-credentials/
... http://metadata.google.internal/computeMetadata/v1/
... http://169.254.169.254/metadata/instance
@{LOCALHOST_VARIANTS}
... http://127.0.0.1/
... http://localhost/
... http://0.0.0.0/
@{CVE_2024_29415_BYPASSES}
... http://127.1/
... http://0x7f000001/
... http://2130706433/
... http://012.0.0.1/
@{INTERNAL_RANGES}
... http://192.168.1.1/
... http://10.0.0.1/
... http://172.16.0.1/
@{METADATA_MARKERS}
... ami-id instance-id computeMetadata
... access_key secret_access_key security-credentials
*** Test Cases ***
SSRF Cloud Metadata Endpoints Must Be Rejected
Create Session app ${BASE_URL}
FOR ${payload} IN @{CLOUD_METADATA}
${response}= POST On Session app /api/fetch-url
... json={"url": "${payload}"} expected_status=any
Should Be True ${response.status_code} in [400, 403, 422]
... msg=Cloud metadata payload not rejected: ${payload}
FOR ${marker} IN @{METADATA_MARKERS}
Should Not Contain ${response.text} ${marker}
END
END
SSRF Localhost Variants Must Be Rejected
Create Session app ${BASE_URL}
FOR ${payload} IN @{LOCALHOST_VARIANTS}
${response}= POST On Session app /api/fetch-url
... json={"url": "${payload}"} expected_status=any
Should Be True ${response.status_code} in [400, 403, 422]
... msg=Localhost variant not rejected: ${payload}
END
SSRF CVE-2024-29415 Bypass Representations Must Be Rejected
# non-standard IP formats that bypass naive isPublic() checks
Create Session app ${BASE_URL}
FOR ${payload} IN @{CVE_2024_29415_BYPASSES}
${response}= POST On Session app /api/fetch-url
... json={"url": "${payload}"} expected_status=any
Should Be True ${response.status_code} in [400, 403, 422]
... msg=CVE-2024-29415 bypass not blocked: ${payload}
END
SSRF Internal Network Ranges Must Be Rejected
Create Session app ${BASE_URL}
FOR ${payload} IN @{INTERNAL_RANGES}
${response}= POST On Session app /api/fetch-url
... json={"url": "${payload}"} expected_status=any
Should Be True ${response.status_code} in [400, 403, 422]
... msg=Internal range not rejected: ${payload}
END
SSRF Valid External URL Still Works
# confirm protection does not break legitimate requests
Create Session app ${BASE_URL}
${response}= POST On Session app /api/fetch-url
... json={"url": "https://httpbin.org/get"}
Should Be Equal As Strings ${response.status_code} 200
TypeScript — Playwright API testing
import { test, expect, APIRequestContext } from '@playwright/test';
const SSRF_PAYLOADS = {
cloudMetadata: [
'http://169.254.169.254/latest/meta-data/',
'http://169.254.169.254/latest/meta-data/iam/security-credentials/',
'http://metadata.google.internal/computeMetadata/v1/',
'http://169.254.169.254/metadata/instance',
],
localhostVariants: [
'http://127.0.0.1/',
'http://localhost/',
'http://0.0.0.0/',
],
// CVE-2024-29415: non-standard representations bypass isPublic()
cve202429415Bypasses: [
'http://127.1/',
'http://0x7f000001/',
'http://2130706433/',
'http://012.0.0.1/',
],
internalRanges: [
'http://192.168.1.1/',
'http://10.0.0.1/',
'http://172.16.0.1/',
],
};
const METADATA_MARKERS = [
'ami-id', 'instance-id', 'computeMetadata',
'access_key', 'secret_access_key', 'security-credentials',
];
let apiContext: APIRequestContext;
test.beforeAll(async ({ playwright }) => {
apiContext = await playwright.request.newContext({
baseURL: 'https://your-app.com',
});
await apiContext.post('/login', {
data: { username: 'testuser', password: 'test_password' }
});
});
test.afterAll(async () => {
await apiContext.dispose();
});
for (const payload of SSRF_PAYLOADS.cloudMetadata) {
test(`SSRF — cloud metadata rejected: ${payload}`, async () => {
const response = await apiContext.post('/api/fetch-url', {
data: { url: payload }
});
expect(
[400, 403, 422],
`Cloud metadata payload not rejected: ${payload}`
).toContain(response.status());
const body = await response.text();
for (const marker of METADATA_MARKERS) {
expect(body, `Metadata marker '${marker}' found for: ${payload}`)
.not.toContain(marker);
}
});
}
for (const payload of SSRF_PAYLOADS.localhostVariants) {
test(`SSRF — localhost variant rejected: ${payload}`, async () => {
const response = await apiContext.post('/api/fetch-url', {
data: { url: payload }
});
expect(
[400, 403, 422],
`Localhost variant not rejected: ${payload}`
).toContain(response.status());
});
}
for (const payload of SSRF_PAYLOADS.cve202429415Bypasses) {
test(`SSRF — CVE-2024-29415 bypass rejected: ${payload}`, async () => {
// non-standard IP formats that bypass naive isPublic() checks
const response = await apiContext.post('/api/fetch-url', {
data: { url: payload }
});
expect(
[400, 403, 422],
`CVE-2024-29415 bypass not blocked: ${payload}`
).toContain(response.status());
});
}
for (const payload of SSRF_PAYLOADS.internalRanges) {
test(`SSRF — internal range rejected: ${payload}`, async () => {
const response = await apiContext.post('/api/fetch-url', {
data: { url: payload }
});
expect(
[400, 403, 422],
`Internal range not rejected: ${payload}`
).toContain(response.status());
});
}
test('SSRF — valid external URL still works', async () => {
// confirm SSRF protection does not break legitimate requests
const response = await apiContext.post('/api/fetch-url', {
data: { url: 'https://httpbin.org/get' }
});
expect(response.status()).toBe(200);
});
Run SSRF tests in isolation:
npx playwright test --grep "SSRF"
CI/CD gate
ssrf-security-tests:
stage: test
script:
- pytest tests/security/test_ssrf.py -v
- npx playwright test --grep "SSRF"
rules:
- if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
allow_failure: false
Pair with a Semgrep rule that flags calls to requests.get(), fetch(), or axios.get() where the URL argument derives from user input without a preceding allowlist check. The static check catches new vulnerable patterns before they reach the test environment.
Environment note
SSRF behavior changes significantly between local development and cloud deployment. A test that passes locally because the development environment has no metadata service may completely miss that the same request succeeds in production against http://169.254.169.254/.
Run your SSRF payload suite against an environment that mirrors the cloud infrastructure, ideally one where the metadata service is reachable so a successful bypass is caught as a test failure rather than silently passing.
If you run on Kubernetes, also test against internal service DNS names resolvable from within the cluster, since SSRF in a Kubernetes environment can expose the API server and other cluster-internal services.
Why AI fails here
When a team asks GitHub Copilot to write tests for a URL-fetching endpoint, it writes tests that submit a valid external URL and assert that content is returned correctly. The SSRF protection layer is never exercised because the test inputs are exactly what the protection was never designed to intercept.
The structural reason LLMs fail at SSRF: the vulnerability exists in the relationship between the feature and the infrastructure around it.
Testing for SSRF requires knowing that http://169.254.169.254/ is significant, that http://127.1/ resolves to loopback, and that a cloud server's network context gives it access to resources an internet client cannot reach. This context does not come from the code being tested. It comes from understanding the deployment environment, the cloud provider's architecture, and the history of SSRF bypass techniques.
The concrete failure: a team builds a webhook delivery system that validates the destination URL before sending. They use ip.isPublic() as the guard. Copilot generates twelve tests. All pass. The tests submit valid external domains and assert they are accepted. The tests submit obvious private addresses like http://192.168.1.1/ and assert they are rejected. Three months after release, a penetration tester submits http://127.1/admin as the webhook URL. isPublic("127.1") returns true. The server makes the request. The tester receives the internal admin panel response. The Copilot suite had zero tests for non-standard IP representations.
How to prevent
1. Allowlist of permitted outbound destinations — define the specific external domains or IP ranges your application legitimately needs to reach in each feature and permit only those. Every other destination is rejected before any network request is made. An allowlist does not need to enumerate all possible attack representations. If the destination is not explicitly permitted, it is rejected by default.
2. Post-resolution IP validation — after resolving a user supplied hostname to its canonical IP address, check the resolved IP against forbidden ranges using a hardened library that handles all standard and non-standard representations. This catches DNS rebinding attacks because the check happens on the resolved IP, not the original hostname. It catches encoding bypass attacks because the resolved IP is always in standard dotted-decimal notation after resolution.
3. Network-level defense in depth — configure your deployment infrastructure so that application servers running user-facing features cannot reach the cloud metadata service, internal database ports, or Kubernetes API server even if application-level SSRF protection fails. On AWS, use IMDSv2 to prevent unauthenticated metadata retrieval. Apply security group rules that explicitly deny outbound connections from application servers to internal service ranges.
Prevention only works when the SSRF payload suite verifies it under adversarial inputs, including the non-standard IP representations that bypass naive checks. A validation function that blocks 127.0.0.1 but allows 127.1 is not a validation function. The test suite is the only way to know the difference.
Conclusion
SSRF in those environments is not a theoretical finding. It is the vector that collapses the boundary between the public internet and internal control plane infrastructure.
The consistent pattern across every system I have tested: developers did not fail to implement SSRF protection. They implemented it using blocklists, trusted library functions without testing edge cases, and never generated the adversarial payloads that would have revealed the gaps.
Writing a test that submits http://127.1/ takes thirty seconds. Not writing it costs you the metadata service.
Part of the Break It on Purpose series, published weekly for QA
engineers and SDETs who find bugs before attackers do.