Return to topic cards

Understanding SSRF

CybersecuritySSRFWeb SecurityInput ValidationVulnerability

Server-Side Request Forgery (SSRF) is a critical cybersecurity vulnerability where an attacker manipulates a server into making unauthorized requests. This can result in unauthorized access to internal resources or sensitive information.

Key Points

  • SSRF involves tricking a server to perform actions it should not.
  • Attackers exploit weaknesses in input validation to target internal or external resources.
  • Common targets include local servers, internal networks, and cloud services.

Scenario - I: SSRF Against a Local Server

In this scenario, the attacker makes an unauthorized request to the server hosting the web application. The attacker typically supplies a loopback IP address or localhost to receive the response.

Example

Consider a URL that takes an url parameter. If this parameter is not properly sanitized, an attacker could potentially access configuration files on the server.

http://example.com/fetch?url=http://localhost/config.php

Scenario - II: Accessing an Internal Server

In this scenario, the attacker exploits a vulnerable web application's input validation to trick the server into requesting internal resources on the same network.

Technical Details

  • This is achieved through manipulated input, such as special IP addresses (like 192.168.x.x or 10.x.x.x for IPv4) or domain names (e.g., internal-database.hrms.thm).
  • When not properly sanitized, these inputs can be used in functions like HTTP requests or file inclusions within the web application.
  • The server, interpreting these requests as legitimate, then inadvertently performs actions or retrieves data from other internal services.

Example

During the reconnaissance stage, an attacker discovers the IP address of an admin panel but cannot access it directly because it is restricted to machines within the same network. However, they notice that a dropdown in the page's source code is connected to this admin panel. By overriding the code source of the page and executing the action on the front end, the attacker can access a private page.

Learn More

To further understand SSRF and its implications, consider exploring the following resources:

  • OWASP SSRF Prevention Cheat Sheet: Provides guidelines on preventing SSRF attacks.
  • PortSwigger's SSRF Guide: Offers in-depth explanations and practical examples.