AI Security
Advanced 12 min read AI Security

SSRF in Tool Calls

Don't let the model phone home

SSRF lets a crafted URL make the model fetch internal services. URL tools must constrain protocol, hosts, and resolution paths so a model-picked link can't reach your metadata endpoint.

ssrfurl toolinternal networkallowlistmetadatafetch
Prerequisites: Tool Security
Before we start

What you will learn

  • Recognize SSRF in URL tools
  • Enforce protocol/host allowlists
  • Guard DNS and redirects
Introduction

What is this?

SSRF (server-side request forgery) occurs when a model-chosen URL causes your server to fetch internal or metadata endpoints (169.254.169.254, localhost, internal CIDRs). Defenses: scheme allowlists (https only), host allowlists with DNS verification, blocking private/loopback ranges, and disallowing redirects that slip past checks.

Motivation

Why do you need it?

  • Models happily fetch whatever URL they're told to.
  • Internal endpoints carry secrets metadata and config.
  • Allowlists beat denylists against network creativity.
  • Redirects and DNS tricks can bypass naive host checks.
Think about it

Mental model

Imagine

A phone that only calls white-listed numbers

Think of

SSRF control

You don't give a kid a phone that can dial any internal extension listed in the phone book on the caller's say-so. The device (tool) only permits whitelisted area codes, verifies the number against a registry, and drops reroutes. Open dialing is just deferred breaches.

Mechanics

How it works

  • Scheme allowlist: https (or http-only for test).
  • Host allowlist: exact domains / suffix rules.
  • Resolution check: block loopback, link-local, private ranges.
  • Redirect policy: refuse cross-host or cross-scheme redirects.
  • Reverse DNS/pinned IP verify the resolved address.

Fetch gate.

URL
Scheme
Host
Resolve
Fetch
Real world

In production

  • Web tools allow only public product domains.
  • Fetch tools block the cloud metadata address.
  • Redirects cross-checked before following.
Guidelines

Best practices

  • Scheme allowlist before any DNS.
  • Check the RESOLVED address, not just the hostname.
  • Block private/loopback/link-local address families.
  • Vet redirects: scheme and host must re-pass the gate.
Watch out

Common mistakes

  • Host-string checks that DNS-rebindings evade.
  • http:// allowed 'because it's just for testing'.
  • Following redirects blindly to internal targets.
Root cause analysis

Common issues

Error
Fetch tool reaches metadata endpoint
Root cause

Link-local not blocked

Fix

Block 169.254.0.0/16, loopback, private ranges at resolve.

Error
Allowlist too narrow blocks legit sites
Root cause

Static single domain

Fix

Suffix-style allowlist + review process for new hosts.

When things break

Debugging tips

  • Internal IP hit → resolve-time check missing; pin the address.
  • Rebinding bypass → resolver used a different IP than the check; single-resolve.
  • Redirect leaked → forbid cross-host redirects.
Interviews

Interview checkpoint

Test yourself

Quick quiz

0/2
1

The strongest SSRF control is…

2

Redirects can bypass host-only SSRF checks.

Go deeper

Official documentation

SSRF (OWASP)
docs