SSRF Backslash-At URL Authority Confusion

How the attack works

An attacker crafts a URL (or embeds one in a request body) where a backslash, or its encoded form %5C or %255C, sits directly in front of an '@' character. vLLM's URL validator parses this string one way and decides the destination is an approved external host. The underlying HTTP client library parses the same string differently and dials whatever comes after the '@', which points at loopback, private network ranges, link-local addresses, cloud metadata endpoints, obfuscated IP formats, or internal hostnames. The result is the server making an outbound request to an internal resource that should have been blocked.

Netzilo detection

Why it matters

An attacker can use the vulnerable server as a proxy to reach internal services, including cloud metadata endpoints that often hand out credentials, or other machines on the internal network that are not meant to be reachable from outside.

What you can do

• →Upgrade vLLM to version 0.17.0 or later, where this parsing mismatch is fixed.
• →If upgrading is not immediately possible, block outbound requests to loopback, RFC1918, link-local, and cloud metadata addresses at the network layer rather than relying on application-side URL validation.
• →Review any outbound HTTP requests containing a backslash immediately before '@' in the URL, and treat those hitting internal or metadata addresses as suspicious unless tied to known test or fuzzing activity.
• →Log and alert on requests to cloud metadata endpoints (e.g. 169.254.169.254) from application servers, since this is a common target for this class of bypass.

Known benign look-alikes

• Authorised SSRF regression tests, red-team tooling or security fuzzing corpora deliberately POSTing backslash-@ payloads at a local or internal model server - expected to fire; correlate with the change/test ticket.
• A URL whose userinfo password legitimately contains a percent-encoded backslash (https://user:p%5Cssw@host/). The script suppresses this by requiring a hard private/metadata/obfuscated IP target whenever a credential (colon-bearing) segment precedes the '@'; a bare internal hostname alone will not fire in that case.
• Internal service URLs using a single-label hostname where a client library emits a stray escaped backslash in the authority - rare, and still worth reviewing because the parse is genuinely ambiguous.
• Documentation, SSRF cheat-sheets or CVE write-ups transmitted as an HTTP body to an internal wiki. Suppressed unless the payload's own effective host is internal, but a payload list that names 169.254.169.254 will match by design.

References

• https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/
• https://github.com/vllm-project/vllm/releases
• https://cwe.mitre.org/data/definitions/918.html