- Analyzer
- dast
- Category
- SSRF
- Default severity
- Not encoded
- CWE
- Not encoded
- Execution
- Active
- Authentication
- Not required
- Applicability
- url
- Availability
- stable
What it detects
URL-shaped inputs whose responses indicate server-side fetching of a supplied destination.
Evidence
The controlled destination and response behavior associated with the probe.
Remediation
Allowlist outbound destinations and block private, loopback, link-local, and metadata addresses after resolution.
Limitations
This check is limited to the applicability and evidence delivered by dast. Review the evidence in context; a match is a finding input, while confidence and policy determine its disposition.
Related reference
Analyzer Registry · Findings and release decisions · Policy and confidence · Active testing
Remediation guidance: Remediation and fix verification · Baselines and suppressions