Lesson 5.8: Server-side request forgery (SSRF)
Some features make the server fetch a URL: link previews, image imports, webhooks. If the visitor chooses the URL, they borrow the server's position in the network: services that listen only on localhost, the internal network behind the firewall, the cloud provider's metadata service with its secrets, and local files through file://. In the lab the shop's review preview fetches any URL. You find what only the server can reach, read an internal admin panel, cloud user data and /etc/passwd through it, then restrict it to an allowlist of HTTPS hosts and prove the fix.
19 min
You will learn to
- Explain SSRF and why the server's network position matters
- Name typical SSRF targets: localhost services, internal networks, cloud metadata, file://
- Find the fetching code
- Restrict outgoing requests with a scheme and host allowlist
- Name network-level defences against SSRF
Key terms
- Server-side request forgery (SSRF)
- Making a server send requests to a destination the attacker chooses.
- Metadata service
- A service at 169.254.169.254 on cloud servers that tells a machine about itself: name, network, startup script, sometimes temporary credentials.
- Link-local address
- An address valid only on the local network segment, such as 169.254.0.0/16 (IPv4) or fe80::/10 (IPv6).
- URL scheme
- The part before :// that tells the program how to fetch: https, http, file, ftp, gopher …
- Egress filtering
- Firewall rules that limit which destinations a server may connect to.
← Auditing with auditd · All lessons · Cryptographic mistakes in code →