SSRF Double-Slash LFR Bypass via GitHub URL Parameter on GCP Cloud Run

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•4

Detects Server-Side Request Forgery (SSRF) attempts exploiting URL parser differentials. Attackers append a double-slash sequence to a legitimate github.com blob URL to trick the backend into resolving an absolute local filesystem path. The rule specifically targets sensitive paths such as /proc/self/environ, /var/task/, and application source files to perform Local File Read (LFR) or access internal cloud metadata services.