GET /api/Image?url=https://example.com/image.png HTTP/1.1 The server code (simplified) looks like:
http://[::1]:3000/encryptionkey.txt
http://localtest.me/encryptionkey.txt (if localtest.me resolves to 127.0.0.1) Use SSRF to probe internal IP ranges (e.g., 192.168.1.1 , 10.0.0.1 , 172.16.0.1 ). Example: owasp juice shop ssrf
The challenge is solved when the student successfully extracts encryptionkey.txt . The OWASP Juice Shop SSRF challenge provides a realistic, hands-on example of how an innocent-looking image fetch endpoint can become a gateway to internal resources. By exploiting it, attackers can read local files, scan internal networks, and steal cloud credentials. Mitigation requires strict allowlisting, network controls, and never trusting user-supplied URLs.
SSRF occurs when an application fetches a remote resource based on user-supplied input without proper validation. In Juice Shop, the vulnerability is deliberately placed to educate developers on risks like internal network scanning, localhost access, and cloud metadata endpoint extraction. 2.1 Vulnerable Endpoint The primary SSRF vector in Juice Shop (version 14+) is the /api/Image endpoint. This endpoint accepts a URL parameter and attempts to fetch an image from that location. GET /api/Image
const isLocalhost = (url) => ; if (isLocalhost(url)) return res.status(400).send('Localhost requests blocked');
curl "http://localhost:3000/api/Image?url=http://localhost:3000/encryptionkey.txt" HTTP 200 with the encryption key in the body (may be text/plain despite image content-type header). 5. Impact Assessment | Attack Vector | Impact | |---------------|--------| | Localhost file read | Exposure of source code, config files, secrets | | Internal port scan | Discovery of admin panels, databases, Redis, Jenkins | | Cloud metadata theft | IAM credentials, access tokens → cloud account compromise | | Service interaction (e.g., Redis, Memcached) | Potential RCE via protocol smuggling | By exploiting it, attackers can read local files,
GET /api/Image?url=http://localhost:3000/encryptionkey.txt If the challenge is active, the server will fetch that internal resource and return its content inside the image response (or as plain text if content type mismatches).