Vulnerabilities · 89 days ago
A public URL-fetch parameter in a cloud app can become a compromise path, not just an SSRF bug. If the service makes the request inside its own trust boundary, weak URL checks can still end in credentials or local files leaving the runtime.
Wiz’s Red Agent found that pattern on a GCP Cloud Run service with a ?url= parameter. It took three runs and about 96 requests to chain URL validation bypasses into SSRF-to-local-file-read, after the service blocked a direct metadata-server pivot but still exposed source and GCP credentials.
The hard part is the reasoning, not the first probe. Any internet-facing cloud app that fetches user-supplied URLs and can reach metadata or internal files carries the same blast radius, even if the blocklist appears to stop the obvious metadata URL.
1 source covering this story
The Red Agent POV: How it Reasoned its Way to SSRF | Wiz Blog
Part 1: How the Red Agent uncovered a multi-step attack chain allowing SSRF-to-Local-File-Read on a GCP Cloud Run API
Part of the PlainSec briefing for 2026-06-17