GCP Cloud Run double-slash LFR bypass via ?url= parameter parser differential

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•5

Detects incoming web requests to GCP Cloud Run services that exhibit patterns associated with Server-Side Request Forgery (SSRF) exploitation. The rule monitors for URLs containing GitHub blob paths combined with path traversal sequences ('//') that point to sensitive internal system paths such as /proc/, /etc/, or /var/task/.