The 'I'll fetch any URL you give me' bug
Server Side Request Forgery

A SaaS app ships a nice feature: paste any URL and we will generate a preview card.

1. 1
   Find the feature

   The attacker pastes https://example.com and watches the response — a preview with title and og:image. Clearly a server-side fetch.
2. 2
   Point it inward

   They paste http://169.254.169.254/latest/meta-data/iam/security-credentials/ — the AWS EC2 instance metadata endpoint. The preview card comes back with the name of an IAM role.
3. 3
   Drill down

   They paste the full credentials URL. The preview now contains a valid AccessKeyId, SecretAccessKey, and Token — the temporary credentials the EC2 instance uses to talk to S3.
4. 4
   Walk into the bucket

   They configure awscli with the stolen token and list buckets. The application's S3 bucket — which holds every user's uploaded document — is now readable from the attacker's laptop.

A link-preview feature became a full AWS credential theft. No password was cracked, no dependency was exploited, no shell was opened. The server was just too polite about which URLs it would fetch.

// app/api/preview/route.ts
export async function POST(req: Request) {
  const { url } = await req.json();

  // Whatever URL the user hands us, we go get it.
  const res = await fetch(url);
  const html = await res.text();

  return Response.json({
    title: extractTitle(html),
    image: extractOgImage(html),
  });
}

// app/api/preview/route.ts
import { lookup } from 'dns/promises';
import ipaddr from 'ipaddr.js';

async function isPublic(hostname: string) {
  const { address } = await lookup(hostname);
  const parsed = ipaddr.parse(address);
  const range = parsed.range(); // 'private', 'loopback', 'linkLocal', 'unicast'...
  return range === 'unicast';
}

export async function POST(req: Request) {
  const { url } = await req.json();
  const parsed = new URL(url);

  if (parsed.protocol !== 'https:') {
    return Response.json({ error: 'https only' }, { status: 400 });
  }
  if (!(await isPublic(parsed.hostname))) {
    return Response.json({ error: 'internal address' }, { status: 400 });
  }

  // Resolve once, forbid redirects so the check cannot be bypassed.
  const res = await fetch(parsed.toString(), {
    redirect: 'error',
    signal: AbortSignal.timeout(5_000),
  });
  const html = await res.text();

  return Response.json({
    title: extractTitle(html),
    image: extractOgImage(html),
  });
}

Three things matter. Resolve the hostname yourself before the fetch. Reject private, loopback, and link-local ranges. Disable redirect following — otherwise attacker.com can 302 into 169.254.169.254 and the check you did on the original URL is useless.