Zennoxa Shield
Rules / PHP
SHIELD-PHP-011

Server-side request forgery via dynamic URL

highPHPCWE-918CVSS 8.6

What it detects

curl target or remote file_get_contents URL is built from a variable, enabling SSRF.

How to fix

Validate and allowlist destination hosts; reject internal/link-local addresses.

Vulnerable — Shield flags thisfetch.php
<?php
// URL preview fetcher — vulnerable to SSRF (?url=http://169.254.169.254/)
$url = $_GET['url'];
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
echo curl_exec($ch);
Fixed — scans cleanfetch.php
<?php
// Only allowlisted, fully known destinations can be fetched
$targets = [
    'status'  => 'https://status.example.com/api/summary',
    'weather' => 'https://weather.example.com/api/today',
];
$name = filter_var($_GET['service'] ?? '', FILTER_VALIDATE_REGEXP, ['options' => ['regexp' => '/^(status|weather)$/']]);
if ($name === false) {
    http_response_code(400);
    exit;
}
$ch = curl_init($targets[$name]);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
echo curl_exec($ch);

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-PHP-011, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-PHP-011: Server-side request forgery via dynamic URL — Zennoxa Shield