The Ravens’ tool fetches a preview of any URL you give it. The request leaves from the server, not your browser, so the server can reach internal places you cannot — including an internal admin panel on the server’s own local address.
A preview tool in Ravens Tools takes a URL and the server itself fetches it and shows the content. There is no filter, so you can point the server at internal addresses you cannot reach from outside, like an admin panel on 127.0.0.1.
Make the server fetch its internal admin panel on its local address and get the master stash code.
You made the server fetch its internal admin panel.
Why the solution worked
This is SSRF, server-side request forgery. You control a URL the server fetches, so you make it request internal resources your own network cannot reach, like local services or admin panels. The fix: do not let the user freely choose a destination the server fetches; use an allowlist of permitted URLs, block internal and loopback addresses, and isolate the fetching service in a network that cannot reach sensitive resources.
The root cause
The server fetches any user-supplied URL with no allowlist and no check that the destination is public, becoming a proxy into the internal network.
How the code is fixed
Rule: allowlist destinations, do not blacklist them, and block internal access from the fetching service at the network level too.
Vulnerable code
app.post('/fetch', async (req, res) => {
// Fetches whatever the user asked for — including internal addresses.
const r = await fetch(req.body.url);
res.send(await r.text());
});
Safe code
const ALLOW = new Set(['https://images.cdn.example', 'https://docs.example']);
app.post('/fetch', async (req, res) => {
const url = new URL(req.body.url);
// Allowlist the destination; block internal/loopback; no redirects to them.
if (!ALLOW.has(url.origin)) return res.status(400).end();
const r = await fetch(url, { redirect: 'error' });
res.send(await r.text());
});
Impact in the real world
SSRF reaches internal services, admin panels and the cloud metadata service, and has caused major breaches by leaking cloud keys.
How defenders detect it
Defenders monitor outbound requests from the server toward internal or private ranges, enforce a destination allowlist, and block redirects.
