Server-Side Request Forgery (SSRF)

What it is

Server-Side Request Forgery (SSRF) is a vulnerability that allows an attacker to induce the server to make HTTP requests to an arbitrary destination — internal services, cloud metadata endpoints, or external systems. In cloud environments, SSRF is particularly severe as it commonly exposes AWS/GCP/Azure metadata credentials that grant broad cloud access.

Attack Vectors

• URL parameters for loading remote resources
• File upload by URL (avatar, image import)
• Webhook endpoint configuration fields
• PDF generators with URL input
• API integrations with user-supplied callback URLs
• Image proxy services

Testing Methodology

1. Submit http://127.0.0.1/ to test access to localhost
2. Try http://169.254.169.254/latest/meta-data/ for AWS metadata
3. Test internal network ranges: http://192.168.0.1, http://10.0.0.1
4. Use DNS rebinding or out-of-band callbacks for blind SSRF detection
5. Test URI scheme variations: file://, gopher://, dict://

Indicators of Vulnerability

• Response contains internal service content or cloud metadata
• DNS/HTTP request received on attacker-controlled server for blind SSRF
• Different response for internal vs external URLs
• Cloud credentials (access keys, tokens) in response

Detection Guidance

Block outbound requests to RFC 1918 and link-local address ranges. Use a cloud metadata protection mechanism. Monitor for requests to 169.254.169.254.

Mitigation & Remediation

• Validate and allowlist target URLs against permitted external domains
• Block requests to RFC 1918 ranges, loopback, and link-local addresses
• Use a dedicated network policy to restrict outbound server requests
• Disable unnecessary URI schemes (file://, gopher://, dict://)
• In cloud environments, use IMDSv2 (requiring PUT requests with tokens) to prevent SSRF metadata access

References

• OWASP SSRF
• PortSwigger SSRF
• OWASP SSRF Prevention Cheat Sheet
• OWASP Hunting — Server-Side Request Forgery (SSRF) (upstream)