Description

SSRF is a vulnerability that takes place when an application retrieves remote resources without validating user input. An attacker can supply their own input, in the form of a URL, to control the remote resources that are retrieved by the targeted server.

SSRF IMPACT

Attackers can provide URLs that may:
Expose private data.
Scan the target’s internal network.
Potentially lead to remote code execution on the target.

SSRF Types

In-Band SSRF:

• The server responds with the resources specified by the attacker.
• Example: If an attacker sends a payload like http://google.com, the server would request the page and return the information from Google to the attacker.

Scenario: A URL is specified in the request, and the content of the URL is displayed back to the attacker in the response.

Intercepted Request:

POST api/v1/store/products
headers...
{
    "inventory": "http://store.com/api/v3/inventory/item/12345"
}

Attack:

POST api/v1/store/products
headers...
{
    "inventory": "http://localhost/secrets"
}

Response:

HTTP/1.1 200 OK
headers...
{
    "secret_token": "crapi-admin"
}

Blind SSRF:

• The server makes the request, but does not send the response back to the attacker.
• The attacker has to rely on external services (like a web server) to confirm that the server made the request.

Scenario: The server makes the request, but does not provide feedback to the attacker.

Intercepted Request:

POST api/v1/store/products
headers...
{
    "inventory": "http://store.com/api/v3/inventory/item/12345"
}

Attack:

POST api/v1/store/products
headers...
{
    "inventory": "http://localhost/secrets"
}

Response:

HTTP/1.1 200 OK
headers...
{}

Challenge:
There is no visible indication that the attack was successful.
You would need to provide a URL to a web server under your control to track whether the server made the request.

Solution:

• Tools like Burp Suite Collaborator can help by setting up a web server to capture request details.
• Free tools like http://webhook.site can be used to verify if the server makes a request to your specified URL.

Ingredients for SSRF

When targeting an API for SSRF vulnerabilities, you will want to look for requests that have any of the following:

1. Include full URLs in the POST body or parameters
2. Include URL paths (or partial URLs) in the POST body or parameters
3. Headers that include URLs like Referer
4. Allows for user input that may result in a server retrieving resources

Mitigation

1. Isolate the resource fetching mechanism in your network
2. Input Validation and Whitelisting
3. DNS Filtering ( DNS resolution restrictions to block access to private IP addresses )
4. Metadata Access Protection
5. Authentication and Authorization for Internal Services