Summary
Certain bidder adapters in Prebid Server interpolate user-controlled parameters directly into outbound request URLs without validating host and subdomain values, enabling crafted bid requests to redirect server-side traffic.
Under these conditions, an attacker can abuse the auction flow to make the server issue HTTP requests to unintended destinations, which becomes risky when internal network services or sensitive endpoints are reachable.
Certain bidder adapters in Prebid Server interpolate user-controlled parameters directly into outbound request URLs without validating host and subdomain values, enabling crafted bid requests to redirect server-side traffic.
Under these conditions, an attacker can abuse the auction flow to make the server issue HTTP requests to unintended destinations, which becomes risky when internal network services or sensitive endpoints are reachable.
Affected context
This vulnerability arises within Prebid Server's bidder adapter logic that constructs outbound HTTP requests during real-time ad auctions.
It is relevant when:
- Adapters accept host or subdomain values from user-supplied bid request parameters
- These values are interpolated into URLs without strict validation or allowlisting
- The Prebid Server instance can reach internal services or sensitive external endpoints
The issue tends to manifest in deployments where network egress from the ad server to back-end APIs, metadata services, or other internal infrastructure is permitted.
This vulnerability arises within Prebid Server's bidder adapter logic that constructs outbound HTTP requests during real-time ad auctions.
It is relevant when:
- Adapters accept host or subdomain values from user-supplied bid request parameters
- These values are interpolated into URLs without strict validation or allowlisting
- The Prebid Server instance can reach internal services or sensitive external endpoints
The issue tends to manifest in deployments where network egress from the ad server to back-end APIs, metadata services, or other internal infrastructure is permitted.
Exploit preconditions
- Attack surface: HTTP(S) bid request interface exposed to demand partners, exchanges, or other upstream traffic sources
- Required access: Ability to submit or influence bid requests containing adapter parameters (e.g., bidder configuration fields, custom host/subdomain values)
- Trigger point: Construction of outbound adapter request URLs using unvalidated parameters followed by server-side HTTP requests during auction processing
- Why exploitation is possible: The server trusts and directly interpolates attacker-controlled values into request URLs without enforcing strict host validation, DNS restrictions, or network egress controls, allowing redirection of traffic to arbitrary destinations reachable from the server environment.
- Attack surface: HTTP(S) bid request interface exposed to demand partners, exchanges, or other upstream traffic sources
- Required access: Ability to submit or influence bid requests containing adapter parameters (e.g., bidder configuration fields, custom host/subdomain values)
- Trigger point: Construction of outbound adapter request URLs using unvalidated parameters followed by server-side HTTP requests during auction processing
- Why exploitation is possible: The server trusts and directly interpolates attacker-controlled values into request URLs without enforcing strict host validation, DNS restrictions, or network egress controls, allowing redirection of traffic to arbitrary destinations reachable from the server environment.
Why this happens
The root cause is an insecure pattern in outbound request construction where user-supplied parameters are treated as trusted URL components.
In several bidder adapters, host and subdomain values from bid requests are interpolated into the URL for server-side HTTP calls without robust validation against an allowlist or strict schema.
This maps to CWE-918: Server-Side Request Forgery (SSRF), in which an application's back-end HTTP client can be steered by untrusted input to contact unintended internal or external resources, bypassing network trust boundaries and exposing services that would not normally be reachable from the public internet.
The root cause is an insecure pattern in outbound request construction where user-supplied parameters are treated as trusted URL components.
In several bidder adapters, host and subdomain values from bid requests are interpolated into the URL for server-side HTTP calls without robust validation against an allowlist or strict schema.
This maps to CWE-918: Server-Side Request Forgery (SSRF), in which an application's back-end HTTP client can be steered by untrusted input to contact unintended internal or external resources, bypassing network trust boundaries and exposing services that would not normally be reachable from the public internet.
Potential impact
- Attacker may cause the server to probe internal network services and enumerate reachable endpoints
- Attacker could access or relay data from internal HTTP APIs, admin interfaces, or cloud metadata services
- Attacker can attempt to interact with sensitive server endpoints, potentially leading to data leakage
- Attacker may leverage SSRF to pivot into more severe attacks, such as credential theft or further exploitation of internal services
- Logging, monitoring, or billing systems can be polluted with malicious or unexpected outbound traffic patterns
- Attacker may cause the server to probe internal network services and enumerate reachable endpoints
- Attacker could access or relay data from internal HTTP APIs, admin interfaces, or cloud metadata services
- Attacker can attempt to interact with sensitive server endpoints, potentially leading to data leakage
- Attacker may leverage SSRF to pivot into more severe attacks, such as credential theft or further exploitation of internal services
- Logging, monitoring, or billing systems can be polluted with malicious or unexpected outbound traffic patterns
General mitigation guidance
Effective mitigation focuses on controlling how outbound URLs are constructed and where the server is allowed to connect.
Common defensive patterns include:
- Enforcing strict allowlists of permitted hosts and schemes for bidder adapters, rejecting any non-approved destination
- Treating all host, subdomain, and path components derived from external requests as untrusted and applying rigorous validation and normalization
- Centralizing URL construction in a hardened utility that enforces scheme, port, and host restrictions rather than building URLs ad hoc in adapter code
- Applying network-layer egress controls (firewall rules, VPC policies, or service mesh policies) so the ad server cannot reach internal-only or high-value endpoints
- Designing components with least-privilege network access, segmenting services so that an exploited adapter cannot communicate with sensitive infrastructure by default
Effective mitigation focuses on controlling how outbound URLs are constructed and where the server is allowed to connect.
Common defensive patterns include:
- Enforcing strict allowlists of permitted hosts and schemes for bidder adapters, rejecting any non-approved destination
- Treating all host, subdomain, and path components derived from external requests as untrusted and applying rigorous validation and normalization
- Centralizing URL construction in a hardened utility that enforces scheme, port, and host restrictions rather than building URLs ad hoc in adapter code
- Applying network-layer egress controls (firewall rules, VPC policies, or service mesh policies) so the ad server cannot reach internal-only or high-value endpoints
- Designing components with least-privilege network access, segmenting services so that an exploited adapter cannot communicate with sensitive infrastructure by default
How teams detect issues like this
Detection generally combines code-centric and operational approaches:
- Static analysis rules that flag URL construction using untrusted parameters (e.g., host or base URL fields derived directly from request bodies or query parameters)
- Code review checklists that emphasize validation of outbound destinations in adapters, looking for lack of allowlists, missing scheme checks, or dynamic host interpolation
- Centralized configuration policies that define approved bidder endpoints and block adapter code from overriding them with request-supplied values
- Runtime monitoring and anomaly detection for outbound HTTP traffic, focusing on unexpected internal IP ranges, metadata endpoints, or non-standard ports accessed by the ad server
- Use of automated security scanning tools that model SSRF patterns and highlight risky network call sites in the codebase or in infrastructure-as-code definitions
Detection generally combines code-centric and operational approaches:
- Static analysis rules that flag URL construction using untrusted parameters (e.g., host or base URL fields derived directly from request bodies or query parameters)
- Code review checklists that emphasize validation of outbound destinations in adapters, looking for lack of allowlists, missing scheme checks, or dynamic host interpolation
- Centralized configuration policies that define approved bidder endpoints and block adapter code from overriding them with request-supplied values
- Runtime monitoring and anomaly detection for outbound HTTP traffic, focusing on unexpected internal IP ranges, metadata endpoints, or non-standard ports accessed by the ad server
- Use of automated security scanning tools that model SSRF patterns and highlight risky network call sites in the codebase or in infrastructure-as-code definitions
