Server-Side Request Forgery (SSRF)

Description

Server-Side Request Forgery (SSRF) is a vulnerability where an attacker can manipulate the server into making unintended requests on its behalf, potentially accessing internal systems or executing arbitrary actions. This is typically done by tricking the server into making requests to unauthorized or malicious URLs specified by the attacker. Mitigation strategies include input validation, restricting access to sensitive endpoints, and using whitelists for allowed URLs to prevent SSRF attacks.

Remediation

Validate and sanitize any user-supplied URLs or hostnames before making outbound requests. Implement strict allowlists for domains or IP addresses that the server can contact, blocking private or internal addresses if they are not intended for external access. Restrict or remove unnecessary functionality that enables outbound HTTP connections. Keep server software up to date, and consider employing a Web Application Firewall (WAF) or network intrusion detection system to detect suspicious request patterns. Regularly audit logs, configurations, and network rules to confirm no unauthorized access paths are enabled, ensuring SSRF attempts are promptly detected and mitigated.

References

Severity

Owasp

Code: A10:2021

Category: Server-Side Request Forgery (SSRF)

Classification