Laravel Version
13
PHP Version
8.5
Database Driver & Version
No response
Description
When a user-controlled $url is passed directly to Http::get(), it can be abused for SSRF attacks. An attacker can probe ports and internal services on your server (for example, checking whether MySQL is listening on port 3306) or access cloud metadata endpoints such as http://169.254.169.254/latest/meta-data/ on AWS, potentially exposing temporary IAM credentials and allowing further compromise.
Symfony has an implementation for this problem: https://symfony.com/blog/new-in-symfony-5-1-server-side-request-forgery-protection
Steps To Reproduce
If you have an AWS instance created before around 2024, IMDSv1 is enabled by default. Calling Http::get('http://169.254.169.254/latest/meta-data/...') can return the instance's temporary AWS credentials.
Laravel Version
13
PHP Version
8.5
Database Driver & Version
No response
Description
When a user-controlled $url is passed directly to Http::get(), it can be abused for SSRF attacks. An attacker can probe ports and internal services on your server (for example, checking whether MySQL is listening on port 3306) or access cloud metadata endpoints such as http://169.254.169.254/latest/meta-data/ on AWS, potentially exposing temporary IAM credentials and allowing further compromise.
Symfony has an implementation for this problem: https://symfony.com/blog/new-in-symfony-5-1-server-side-request-forgery-protection
Steps To Reproduce
If you have an AWS instance created before around 2024, IMDSv1 is enabled by default. Calling Http::get('http://169.254.169.254/latest/meta-data/...') can return the instance's temporary AWS credentials.