Server-Side Request Forgery (SSRF) Risk Assessment Form
Evaluate SSRF exposure and review safeguards for an application or service. Do not include secrets or sensitive personal or financial information.
Service Context
Service or Application Name
*
Responsible Team or Business Unit
*
Assessment Scope (assessed component and relevant request-handling flow)
*
Request Paths and Safeguards
Sources of URLs or destinations used by server-side requests
User-submitted input
Imported or uploaded content
Webhook or integration configuration
Internal service configuration
Other
SSRF control review
*
Rows
Not implemented
Partially implemented
Implemented
Not applicable
URL parsing and validation
1
2
3
4
Destination allowlisting or blocking
5
6
7
8
Redirects
9
10
11
12
DNS resolution and IP-range validation
13
14
15
16
Outbound network restrictions
17
18
19
20
Potentially reachable destination categories
Public internet
Internal services
Cloud instance metadata services
Localhost or loopback
Not assessed
Existing safeguards and remediation
*
Evidence and Risk Rating
Assessment Evidence or References
Overall SSRF Risk Rating
*
Low
Moderate
High
Critical
Not enough information
Assessment Notes or Follow-up
Submit Assessment
Should be Empty: