[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-1-en-105":3,"doc-seo-573439-105":53,"doc-detail-573439-en":126},{"code":4,"msg":5,"data":6},0,"success",[7,14,19,24,29,34,39,44,49],{"id":8,"doc_module":9,"doc_module_name":10,"category_name":11,"show_sort_weight":12,"slug":13},11,1,"Template","Presentations",90,"presentations",{"id":15,"doc_module":9,"doc_module_name":10,"category_name":16,"show_sort_weight":17,"slug":18},12,"Resumes",80,"resumes",{"id":20,"doc_module":9,"doc_module_name":10,"category_name":21,"show_sort_weight":22,"slug":23},14,"Invoices",70,"invoices",{"id":25,"doc_module":9,"doc_module_name":10,"category_name":26,"show_sort_weight":27,"slug":28},15,"Posters",60,"posters",{"id":30,"doc_module":9,"doc_module_name":10,"category_name":31,"show_sort_weight":32,"slug":33},16,"Social Media",50,"social-media",{"id":35,"doc_module":9,"doc_module_name":10,"category_name":36,"show_sort_weight":37,"slug":38},17,"Forms",40,"forms",{"id":40,"doc_module":9,"doc_module_name":10,"category_name":41,"show_sort_weight":42,"slug":43},18,"Letters",30,"letters",{"id":45,"doc_module":9,"doc_module_name":10,"category_name":46,"show_sort_weight":47,"slug":48},21,"Paper Templates",5,"papers-templates",{"id":50,"doc_module":9,"doc_module_name":10,"category_name":51,"show_sort_weight":4,"slug":52},158,"General","general-158",{"code":4,"msg":54,"data":55},"ok",{"site_id":56,"language":57,"slug":58,"title":59,"keywords":60,"description":61,"schema_data":62,"social_meta":119,"head_meta":121,"extra_data":123,"updated_unix":125},105,"en","ssrf-vs-developers-a-study-of-ssrf-defenses-in-php-applications","SSRF vs. Developers - A Study of SSRF-Defenses in PHP Applications","","Server-side requests (SSR) enable practical web features like link previews and web hooks, but naive SSR usage can introduce Server-Side Request Forgery (SSRF), an underappreciated security risk. The study performs an in-depth analysis of known SSRF exploitation methods and defenses across PHP, then measures prevalence and effectiveness in 27,078 open-source PHP applications. Using data flow analysis and manual validation, it finds defenses are sparse and the hypermajority of detected flows are vulnerable. Only two analyzed applications implement safe SSR features.",{"@graph":63,"@context":118},[64,80,101],{"@type":65,"itemListElement":66},"BreadcrumbList",[67,71,74,77],{"item":68,"name":69,"@type":70,"position":9},"https://docshare.wps.com","Home","ListItem",{"item":72,"name":10,"@type":70,"position":73},"https://docshare.wps.com/template/",2,{"item":75,"name":51,"@type":70,"position":76},"https://docshare.wps.com/template/general/",3,{"item":78,"name":59,"@type":70,"position":79},"https://docshare.wps.com/template/ssrf-vs-developers-a-study-of-ssrf-defenses-in-php-applications/573439/",4,{"url":78,"name":59,"@type":81,"image":82,"author":87,"headline":59,"publisher":90,"fileFormat":93,"inLanguage":57,"description":61,"dateModified":94,"datePublished":95,"encodingFormat":93,"isAccessibleForFree":96,"interactionStatistic":97},"DigitalDocument",{"url":83,"@type":84,"width":85,"height":86},"https://docshare.wps.com/thumbnails/ssrf-vs-developers-a-study-of-ssrf-defenses-in-php-applications/573439.png","ImageObject",442,249,{"name":88,"@type":89},"awa","Person",{"url":68,"name":91,"@type":92},"DocShare","Organization","application/pdf","2026-10-17","2026-10-14",true,{"@type":98,"interactionType":99,"userInteractionCount":79},"InteractionCounter",{"@type":100},"ViewAction",{"@type":102,"mainEntity":103},"FAQPage",[104,110,114],{"name":105,"@type":106,"acceptedAnswer":107},"What is the main focus of the study on SSRF in PHP applications?","Question",{"text":108,"@type":109},"The study analyzes known SSRF exploitation methods and defenses in PHP, then measures how often SSRF-prone patterns and defenses occur in real open-source PHP applications.","Answer",{"name":111,"@type":106,"acceptedAnswer":112},"How do the authors evaluate SSRF prevalence across many PHP repositories?",{"text":113,"@type":109},"They perform an initial data flow analysis to identify attacker-controlled inputs into SSR functions, then use manual analysis to interpret vulnerabilities and assess the defenses found.",{"name":115,"@type":106,"acceptedAnswer":116},"What do the results indicate about the effectiveness of SSRF defenses in practice?",{"text":117,"@type":109},"Defenses are sparse, and the hypermajority of detected data flows are vulnerable; only two analyzed applications implement safe SSR features.","https://schema.org",{"og:url":78,"og:type":120,"og:title":59,"og:site_name":91,"og:description":61},"article",{"robots":122,"canonical":78},"index,follow",{"doc_id":124,"site_id":56},573439,1792108777,{"code":4,"msg":5,"data":127},{"doc_id":124,"user_id":128,"nickname":88,"user_avatar":129,"doc_module":9,"category_id":50,"category_name":51,"doc_title":59,"doc_description":61,"doc_content":130,"file_id":131,"file_url":132,"file_type":133,"file_size":134,"view_count":79,"is_deleted":4,"is_public":9,"is_downloadable":9,"audit_status":9,"page_count":40,"language":135,"language_code":57,"site_id":56,"html_lang":57,"table_of_contents":136,"faqs":137,"seo_title":138,"seo_description":61,"update_tm":139,"read_time":140},3985747858093,"https://ap-avatar.wpscdn.com/davatar_3d24733baf745e90a7e4bdd5f77d97b2","SSRF vs. Developers: A Study of SSRF-Defenses in PHP Applications  \nMalte Wessels∗†, Simon Koch∗†, Giancarlo Pellegrino‡, Martin Johns†† Technische Universität Braunschweig ‡ CISPA Helmholtz Center for Information Security  \n{malte.wessels, simon.koch, [m.johns}@tu-braunschweig.de](m.johns}@tu-braunschweig.de), [pellegrino@cispa.de](pellegrino@cispa.de)  \nAbstract  \nServer-side requests (SSR) are a potent and important tool for modern web applications, as they enable features such as link preview and web hooks. Unfortunately, naive usage of SSR opens the underlying application up to Server-Side Request Forgery – an underappreciated vulnerability risk. To shed light on this vulnerability class, we conduct an in-depth analysis of known exploitation methods as well as defensesand mitigations across PHP. We then proceed to study the prevalence of the vulnerability and defenses across 27,078 open-source PHP applications. For this we perform an initial data flow analysis, identifying attacker-controlled inputs into known SSR functions, followed up by a manual analysis of our results to gain a detailed understanding of the involved vulnerabilities and present defenses. Our results show that defenses are sparse. The hypermajority of our 237 detected data flows are vulnerable. Only two analyzed applications implement safe SSR features.  \nSince known defenses are not used and detected attackercontrolled flows are almost always vulnerable, we can only conclude that developers are still unaware of SSR abuses and the need to defend against them. Consequently, SSRF is a present and underappreciated danger in modern web applications.  \n1 Introduction  \nServer-side requests (SSRs) are a convenient service-toservice communication pattern in which a web service sends [HTTP requests](HTTP requests) to external entities. Modern web applications use SSRs to implement many user-facing functionalities, such as URL previews [36] or integration of third-party content, such as external calendars [16] . While essential in practice, if not implemented correctly, SSRs can be abused, introducing a wide variety of security risks, ranging from attacks such as network reconnaissance [32] to high severity ones such as remote code execution (RCE) attacks.  \n∗Both authors contributed equally to this research.  \nSSRF ranks among the OWASP Top 10 [31] and CWE Top 25 [40] security risks. Recent incidents suggest that web applications are still exposed to SSR vulnerabilities. For example, an attacker recently elevated an attacker-controlled SSR vulnerability affecting Microsoft Exchange servers into an RCE vulnerability, bypassing authentication and firewalls, resulting in email theft [3, 17] . Most recently, PyTorch’s TorchServe suffered from an arbitrary code execution flaw caused by an SSRF flaw, which allowed the attacker to load the malicious model [4] . Even applications that attempt to defend themselves frequently get it wrong, such as vSphere, which employed URL validation but suffered from an information disclosure attack through SSRF [2] .  \nUnfortunately, we know little about the prevalence of SSR vulnerabilities and the effectiveness of the existing defenses, as the research community has given SSRs limited attention. Up to this point, prior work has been conducted only on a small scale and was focused on either understanding and exploring the security risks (i.e., Pellegrino et al. [32]) or novel defenses (i.e., Jabiyev et al. [21]) . This paper addresses this gap by providing a large-scale analysis of SSR threats in PHP web applications.  \nAnalyzing PHP SSRF vulnerabilities, at scale, and the code patterns associated with defenses is particularly challenging. The lack of reliable, scalable and flexible investigation tools hinders such analysis because it requires collecting, analyzing, and reasoning on millions of lines of code. Tools such as PHPJoern [9], a Code Property Graph Generator, have previously been employed in large-scale analysis of PHP pro","cbCaimIXeGFAVdwJ","https://ap.wps.com/l/cbCaimIXeGFAVdwJ","pdf",338136,"English","# Abstract\n# 1 Introduction","[{\"question\":\"What is the main focus of the study on SSRF in PHP applications?\",\"answer\":\"The study analyzes known SSRF exploitation methods and defenses in PHP, then measures how often SSRF-prone patterns and defenses occur in real open-source PHP applications.\"},{\"question\":\"How do the authors evaluate SSRF prevalence across many PHP repositories?\",\"answer\":\"They perform an initial data flow analysis to identify attacker-controlled inputs into SSR functions, then use manual analysis to interpret vulnerabilities and assess the defenses found.\"},{\"question\":\"What do the results indicate about the effectiveness of SSRF defenses in practice?\",\"answer\":\"Defenses are sparse, and the hypermajority of detected data flows are vulnerable; only two analyzed applications implement safe SSR features.\"}]","SSRF vs. Developers - A Study of SSRF-Defenses in PHP Applications | PDF",1791939747,6]