SSRF Vulnerabilities: How 'Paste a URL' Features Can Expose Your Servers

·5 views

Server-Side Request Forgery (SSRF) has risen from an obscure security finding to one of the highest-impact vulnerabilities in the OWASP Top 10, driven by the widespread adoption of features that fetch URLs on a user's behalf. Common examples include webhooks, image proxies, PDF generators, and link preview tools — all of which share the same risk: the server, not the user's browser, makes the outbound request. Because servers typically have access to internal networks and cloud metadata endpoints, an attacker can craft a malicious URL to reach private services, admin panels, or databases that would otherwise be unreachable from the public internet. On major cloud platforms like AWS, GCP, and Azure, this can allow an attacker to retrieve live IAM credentials via the instance metadata endpoint at 169.254.169.254, potentially granting access to storage, databases, and other cloud resources. The vulnerability requires no authentication bypass, no memory corruption, and no deserialization — only a text field that accepts a URL and a server willing to fetch it.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

RAG Explained: How AI Models Answer Questions Using External Documents

Retrieval-Augmented Generation (RAG) is a technique that allows large language models to answer questions using documents they were never trained on, without any retraining or fine-tuning. First introduced in a 2020 Facebook AI Research paper by Patrick Lewis and colleagues, RAG works by searching external documents for relevant passages and feeding them as context to the model before it generates a response. The approach addresses two core limitations of LLMs: knowledge frozen at training time and no access to private or proprietary data. A typical RAG pipeline involves chunking documents, converting them into vector embeddings, storing them in a vector database, and retrieving the closest matches to a user's query at request time. Research has shown that retrieval quality matters significantly, with fewer but more relevant chunks generally outperforming larger, poorly ranked result sets.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI21 Labs cuts 61% of staff, pivots to enterprise AI orchestration amid acquisition rumors

Israeli AI firm AI21 Labs, known for its Jurassic and Jamba language models, laid off 110 of its 180 employees in May 2026 as part of a strategic shift away from standalone model sales toward enterprise orchestration. The company had raised $300 million in mid-2025, bringing its total funding to $636 million, with backing from Google and Nvidia. Its new Maestro platform, announced in March 2025, is designed to coordinate complex, multi-step AI tasks across models from multiple providers. AI21 has also forged cloud partnerships with AWS and Google Cloud to support its infrastructure ambitions. Acquisition interest from Nebius Group has since emerged, highlighting the perceived strategic value of AI21's hybrid Mamba-Transformer architecture and orchestration technology.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why Developers Should Build a Life and Identity Beyond Tech

A developer-focused opinion piece on DEV Community argues that many software professionals unintentionally allow technology to consume their entire personal and social identity. The author observes that because tech work is mentally demanding and desk-bound, developers often lack the energy to socialize outside familiar professional circles, weakening their broader communication skills. This creates a reinforcing cycle where limited outside interaction makes future non-tech socializing feel increasingly uncomfortable. The author recommends pursuing offline hobbies unrelated to technology — such as painting, photography, or book clubs — to practice communicating with people from diverse backgrounds. Joining groups like Toastmasters is also suggested as a structured way to build public speaking and interpersonal skills beyond the tech bubble.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Makes Coding Easier, But Shortcuts Don't Make You an Engineer

On Engineer's Day, observed on September 15 in India, Sri Lanka, and Tanzania, developer Dhruv Jani reflects on how AI coding tools have blurred the line between generating software and truly understanding it. He argues that deploying an AI-built app without grasping its architecture or limitations does not constitute engineering. Jani draws on his own experience rebuilding ShelfTalk, a MERN-stack book-club app, for production as part of GitHub's Finish-Up-A-Thon challenge, where he finished in the top 10 among 500-plus entries. A post-launch bug later revealed that his push-notification optimization silently dropped messages for users viewing ShelfTalk on a second monitor, because tab visibility does not equal user attention. The incident underscored his central point: shipping something that works is not the same as understanding why it works.

0 comments Read more at DEV Community