SSRF
SSRF is a vulnerability in which the attacker gets a web server to send a request to an address of the attacker's choosing. The distinction matters: the request is not sent by the user's browser but by the server. That opens the door to internal services which from the outside ought to remain invisible.
Term
description · examples · notesSSRF is a vulnerability in which the attacker gets a web server to send a request to an address of the attacker's choosing. The distinction matters: the request is not sent by the user's browser but by the server. That opens the door to internal services which from the outside ought to remain invisible.
Description
A typical case is a function that fetches an image from a URL, generates a link preview or checks a remote resource. If the application accepts a user-supplied address without strict control, the attacker can force the server to call an internal IP address, an admin panel, a cloud metadata service or another service behind the protection.
SSRF is especially dangerous in cloud environments. If the server can reach the metadata endpoint, the attacker can try to extract temporary credentials and move from one hole in an application to a compromise of the cloud account.
Examples
- A function that loads an image from a URL is used to make the server call an internal address that is not reachable from the internet.
- Through SSRF the attacker attempts to reach the cloud metadata service and extract temporary credentials.
- A link preview application can be made to scan internal ports and reveal services behind the firewall.
Notes
- With SSRF the problem is not only what the user sees, but what the server can fetch on their behalf.
- A block list of addresses is rarely enough. Better an allowlist, network separation, and the rule that an application may call only what it genuinely needs.
Techniques
carried out with 3Techniques used to carry it out. Select one to open its page.
Defenses
countered by 5How it is defended against. Select one to open its page.