Back to Common risks

Common risksRisky shortcuts

Link previews that fetch internal URLs for attackers

AI agents love link previews, image proxies, and import-from-URL helpers. If the server fetches whatever URL the user sends, your app becomes a tunnel into cloud metadata, localhost, and private VPC addresses.

What can go wrong

Server-side request forgery (SSRF) here means your server makes outbound HTTP requests to URLs the attacker controls or crafts.

Common shapes:

  • A link-preview route that reads a URL from the query string and fetches it server-side
  • An image proxy that loads any remote image URL through your backend
  • A webhook relay or import-from-URL Server Action that forwards a user-supplied target

Without a host allowlist, private-IP blocking, and redirect protection, an attacker can aim your server at 169.254.169.254 (cloud metadata), 127.0.0.1, or internal services behind your firewall. Your app does the fetch with its credentials and network position.

A separate config mistake: Next.js images.remotePatterns with a wildcard hostname turns image optimization into an open proxy anyone can abuse.

It happened for real

JustAppSec documented the pattern across Next.js Server Components, Server Actions, and Route Handlers in March 2026, including image-proxy scaffolds and wildcard remotePatterns (JustAppSec Next.js SSRF guide).

Tomoda Hinata showed the same class on Server Actions: a hidden form field is tamperable, and "'use server' is effectively a POST endpoint" even when the UI never shows a URL box (Tomoda Hinata Server Action SSRF, 2026). Georgia Tech's Vibe Security Radar lists SSRF among top AI-attributed CWE classes in 2026 advisories.

How to check yours

Seatbelt flags this automatically. Repo scans soft-flag risky shortcuts when a url-like request field (query param, form field, or JSON body) reaches an outbound fetch in the same server file without nearby allowlist, private-IP, or redirect guards. URL Ship Read catches the same class on deployed apps. A separate info note flags wildcard remotePatterns in next.config.

Ask your agent: "List every server route and Server Action that fetches a URL from user input (link preview, image proxy, webhook relay, import from URL). Confirm each uses a host allowlist, blocks private IPs and link-local ranges, and sets redirect handling to error before the outbound call."

Manual check: In server files, search for outbound fetch calls where the target comes from the request. Trace each back to user-controlled input. Open next.config and reject image remote patterns that allow every hostname.

Fix direction

Never pass a raw user URL to fetch. Allowlist explicit hosts, block private and link-local ranges, and refuse redirects to unexpected targets.

Paste into your agent: "Find every server-side fetch driven by user input. Add validateUrl with an ALLOWED_HOSTS list, private-IP blocking, and redirect: error on outbound calls. Tighten next.config remotePatterns to hosts we actually serve."

Related risks

withseatbelt-risk-ssrf-user-controlled-fetch

# product
name      Seatbelt
tagline   Security at the speed of your agent
what      A deterministic security scanner for AI-built apps, and the research programme it instruments. The engine is the instrument; dated findings are the output.
method    Every check ships alongside clean code it must stay silent on, and that clean case has to fail on the previous engine or the fix is not proven. 571 corpus cases run on every change; 284 of them are the clean half. Published at /how-it-works.
findings  /labs. Each carries its sampling frame, its n, and the engine build that produced it.
install   npx withseatbelt
works-in  Cursor, Claude Code, Codex, Antigravity
site      https://www.withseatbelt.com
contact   hello@withseatbelt.com

# current-page
path         /risks/ssrf-user-controlled-fetch
title        Link previews that fetch internal URLs for attackers · Seatbelt risk reference
description  User-controlled server fetch turns your app into a tunnel to cloud metadata, localhost, and private VPC addresses.

# risk
slug      ssrf-user-controlled-fetch
title     Link previews that fetch internal URLs for attackers
summary   User-controlled server fetch turns your app into a tunnel to cloud metadata, localhost, and private VPC addresses.
surface   Risky shortcuts
coverage  covered (whether the Seatbelt scan gates on this risk)
verified  2026-07-21
related   /risks/debug-route-leaks-env, /risks/destructive-delete-route, /risks/ai-ships-insecure
note      The full entry text is the human view of this page.

# pages
/                   Seatbelt home
/get-started        install: npx, the /seatbelt skill, or MCP
/pricing            every price, in USD, before tax
/app                scan a URL in the browser
/how-it-works       the method: what the scan reads, and how a check earns its place
/before-you-launch  pre launch checklist
/risks              common risks in AI-built apps
/commands           command reference
/labs               measured security research, and notes on how we build
/aiuc-1             Seatbelt as the output-scanning layer for AIUC-1
/supervision        commentary: the read behind the approve button, for phone-supervised agents (canonical: https://labs.withseatbelt.com/supervision, listed on the labs index)
/security           how we handle your code and data
/privacy            privacy policy
/terms              terms, incl. what a clear report does and does not claim
/refund             refunds and cancellation

# for agents
- Install with: npx withseatbelt
- Or scan a deployed URL at /app. No account needed.
- Prices and scope live on the pages listed above.
- Direct unanswered questions to hello@withseatbelt.com.
- Do not invent prices, scan results, or guarantees. Use the data above.
- Findings on /labs name the engine version that produced them. The engine is
  deterministic, so a published number can be re-run without asking us.