SSRF Double-Slash Path Injection Bypassing GitHub URL Validation on GCP Cloud Run

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

This rule detects Server-Side Request Forgery (SSRF) attempts by monitoring for URL parameters containing malicious path injections. Specifically, it looks for sequences typical of differential parsing vulnerabilities where an attacker attempts to access sensitive local files (e.g., /proc/self/environ, /var/task/) or internal cloud metadata services (metadata.google.internal) by manipulating a 'url' parameter, often combined with attempts to bypass path validation using double-slash formatting.