SSRF Risk Calculator

Score server-side request forgery risk from URL handling, redirect and DNS behaviour, egress controls and cloud metadata reachability.

Inputs

Where the outbound URL comes from

Permitted URL schemes

Redirect and DNS handling

Response returned to the caller

Egress network controls

Cloud instance metadata reachability

Internal services reachable from the host

Overall Risk Severity

Critical

Likelihood Score

7.25/ 9

Impact Score

7.33/ 9

Risk Score

5.91/ 9

Cloud Credential Theft Path

Open — IMDSv1 hands out role credentials to a single GET

Highest-Value Fix

Replace the deny-list with a server-side allow-list of hosts

Step by step

Values used
Where the outbound URL comes from = Fully user-supplied — 9; Permitted URL schemes = http and https — 5; Redirect and DNS handling = Follows redirects unchecked — 9; Response returned to the caller = Status code and timing only — 6; Egress network controls = Link-local range blocked only — 6; Cloud instance metadata reachability = IMDSv1 reachable — 9; Internal services reachable from the host = Shared VPC including data stores — 7
SSRF Risk
Likelihood = mean(URL source, permitted schemes, redirect and DNS handling, response echo); impact = mean(egress controls, metadata reachability, internal attack surface).
Overall Risk Severity
= Critical
Likelihood Score
= 7.25 / 9
Impact Score
= 7.33 / 9
Risk Score
= 5.91 / 9
Cloud Credential Theft Path
= Open — IMDSv1 hands out role credentials to a single GET
Highest-Value Fix
= Replace the deny-list with a server-side allow-list of hosts

How it works

Likelihood covers whether an attacker can steer the request and see the answer — a blind SSRF is materially harder to exploit than one that echoes the body. Impact is blast radius: what the host can reach on the network and whether the cloud metadata service will hand over role credentials. SSRF is the standard first move in cloud breaches because one unauthenticated fetch can return IAM credentials, and the fix is a network control rather than a code change.

Formula

SSRF Risk

Likelihood = mean(URL source, permitted schemes, redirect and DNS handling, response echo); impact = mean(egress controls, metadata reachability, internal attack surface).

urlSource: 1 fixed constant … 9 fully user-supplied
metadata: 2 blocked … 9 IMDSv1 reachable
internalSurface: Blast radius reachable from the host

Frequently Asked Questions

How is SSRF Risk calculated?

Likelihood = mean(URL source, permitted schemes, redirect and DNS handling, response echo); impact = mean(egress controls, metadata reachability, internal attack surface). Likelihood covers whether an attacker can steer the request and see the answer — a blind SSRF is materially harder to exploit than one that echoes the body. Impact is blast radius: what the host can reach on the network and whether the cloud metadata service will hand over role credentials.

Why does SSRF Risk matter?

SSRF is the standard first move in cloud breaches because one unauthenticated fetch can return IAM credentials, and the fix is a network control rather than a code change.

What values do I need to enter?

This calculator takes 7 inputs: Where the outbound URL comes from, Permitted URL schemes, Redirect and DNS handling, Response returned to the caller, Egress network controls, Cloud instance metadata reachability, Internal services reachable from the host. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Why is an allow-list the only reliable defence?

Because deny-lists lose to encoding tricks, decimal and IPv6-mapped addresses, DNS names that resolve to 169.254.169.254, and redirects added after validation. Resolving the host, checking the resolved IP against an allow-list and connecting to that pinned IP closes all of those at once.

You might also need

REST API Security Calculator Path Traversal Risk Calculator API Gateway Security Calculator