# SSRF via Agent Tool Calls

- **Severity:** Critical
- **Signature ID:** `ac7b592e-cb9b-432e-831d-a9c74d8074b7`
- **CVEs:** CVE-2019-5418, CVE-2021-21311
- **MITRE ATLAS:** AML.T0049 (Exploit Public-Facing Application)
- **OWASP:** ASI02 (Tool Misuse and Exploitation), LLM05 (Improper Output Handling), LLM06 (Excessive Agency)

## Summary

An AI agent that can make web requests on a user's behalf can be manipulated into fetching URLs that steal cloud credentials or use disguised addresses to reach internal systems. This detection focuses on the clearest signs of credential theft, not routine internal traffic.

## How the attack works

An attacker gets an agent to issue an outbound HTTP request, either by controlling input the agent processes or by hiding malicious instructions in content the agent reads. The request targets a cloud provider's metadata/IMDS endpoint (AWS, GCP, Azure, DigitalOcean, Oracle, Alibaba) to pull temporary credentials or tokens, or it uses obfuscation — hex/octal-encoded loopback addresses, unusual URI schemes like file/gopher/dict/tftp/ldap, IPv6 loopback variants, DNS-rebinding domains, or a URL shortener that redirects internally — to reach systems it shouldn't. Because these targets and encodings have no legitimate use case for a normal agent task, their presence alone is treated as high-confidence malicious activity. The agent, acting as a proxy with its own network position and often its own IAM role, fetches the data and returns it to the attacker. Note: plain localhost, 127.0.0.1, RFC1918 addresses, and bare internal hostnames are deliberately excluded here since agents legitimately touch those during normal development work.

## Why it matters

Successful exploitation can hand an attacker the agent's cloud credentials or temporary access tokens, enabling further compromise of cloud resources, or let them reach internal services the agent was never meant to expose.

## What you can do

- Block or tightly restrict agent outbound access to cloud metadata/IMDS endpoints (e.g. 169.254.169.254 and provider equivalents) at the network layer.
- Reject or sanitize URLs containing exotic schemes (file, gopher, dict, tftp, ldap) or encoded loopback representations before they reach the agent's HTTP client.
- Apply least-privilege IAM roles to agents so a stolen credential from a metadata service has minimal value.
- Log and review agent outbound requests, especially those following URL shorteners or redirects, to catch internal-redirect abuse.

## Known benign look-alikes

- Agents with legitimate access to internal services explicitly allowlisted
- Development environments where localhost access is expected
- Private network tools designed for internal infrastructure management
- Cloud management tools that legitimately query metadata endpoints
- Service mesh tools that use .internal or .consul DNS names by design

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00013
- https://nvd.nist.gov/vuln/detail/CVE-2019-5418
- https://nvd.nist.gov/vuln/detail/CVE-2021-21311

---
Source: https://www.netzilo.com/threats/atr-ssrf-via-agent-tool-calls