URL-fetching is a core API pattern. That’s why APIs are exposed.
Webhooks, file imports, link previews — all legitimate features, all potential SSRF vectors.
🔗
Webhooks
The API calls a URL you provide when an event occurs. “Call this URL when a payment succeeds.” Attacker provides an internal URL instead of an external callback.
📥
File / data import from URL
“Import your product catalog from this CSV URL.” “Import your profile picture from this image URL.” The server fetches and processes whatever URL the user supplies.
📰
Link preview / metadata fetch
“Paste a URL and we’ll show a preview.” The server fetches the URL to extract title, description, and thumbnail. Social platforms, CMS tools, and chat APIs all do this.
🔄
Third-party integrations / API chaining
“Connect your Slack workspace at this endpoint.” “Pull data from your supplier’s API at this URL.” The server makes outbound requests to URLs the user configured.
🏗️
PDF / screenshot rendering
“Render this URL as a PDF.” Headless browser rendering services fetch the URL the user provides. The browser (running server-side) has full network access.
⚙️
Health checks and monitoring endpoints
Internal monitoring systems that check URLs provided in configuration. If config is user-editable, this is an SSRF vector.