LLMs, GenAI, RAG, agents, evaluation · insight-1605
Gate URL-fetching tools with an egress allow-list instead of the model's judgement
- Evidence type
- practitioner heuristic
- Difficulty
- medium
- Roles
- ML engineer, Applied AI
- Industries
- cross-industry
Summary: situation, action, reason, boundary
Situation
A research or support agent has a fetch-URL tool and runs inside your cloud network.
Action
In the tool, resolve the hostname, check the resolved addresses against public ranges and an allow-listed domain list, disable redirects or re-validate every hop, and cap response size and content type. Run fetchers in a network segment with no route to internal services.
Reason
OWASP's SSRF guidance prefers allow-lists to bypass-prone deny-lists, names the metadata address as a typical target, disables redirects, validates resolved IPs and segments the network. A model-generated URL is untrusted input to that guidance.
Boundary
Browsing, link-preview, document-import and webhook tools that an LLM can drive.
Symptom or risk
Injected text asks for an internal address such as the cloud metadata endpoint; the tool runs with the server's network position and returns credentials or internal pages into the context.
Exceptions
Open-web browsing agents cannot allow-list; use a deny-list plus a sandbox with no credentials and no internal route.
Trade-offs
Allow-lists block legitimate new sites until someone adds them; give users a request path.
Pitfalls
Validating the URL string only, which redirects and DNS rebinding bypass.
Lessons and concepts
Claims and their sources
The OWASP SSRF cheat sheet prefers allow-lists to deny-lists, lists 169.254.169.254 as a cloud metadata address, recommends disabling redirects and validating resolved IPs, and advises network segmentation.
OWASP lists SSRF among the consequences of passing unvalidated model output to downstream components.