GCP Cloud Run SSRF path traversal in GitHub URL repo segment

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•10

Detects Server-Side Request Forgery (SSRF) attempts against a GCP Cloud Run service. The rule identifies malicious payloads targeting the 'url' parameter, which utilize path traversal sequences (e.g., ../, %2f, %5c) to escape the GitHub repository segment or attempt to access sensitive local system files like /proc/self/environ, /app/main.py, or /app/requirements.txt.