No SSRF protection for HTTP client.

[mantas-done]

Laravel Version

13

PHP Version

8.5

Database Driver & Version

No response

Description

When a user-controlled $url is passed directly to Http::get(), it can be abused for SSRF attacks. An attacker can probe ports and internal services on your server (for example, checking whether MySQL is listening on port 3306) or access cloud metadata endpoints such as http://169.254.169.254/latest/meta-data/ on AWS, potentially exposing temporary IAM credentials and allowing further compromise.

Symfony has an implementation for this problem: https://symfony.com/blog/new-in-symfony-5-1-server-side-request-forgery-protection

Steps To Reproduce

If you have an AWS instance created before around 2024, IMDSv1 is enabled by default. Calling Http::get('http://169.254.169.254/latest/meta-data/...') can return the instance's temporary AWS credentials.