Monitoring and Responding to SSRF Incidents

Introduction

Welcome to the third lesson of our Server-Side Request Forgery (SSRF) Prevention in Express course! We've covered what SSRF is and how to prevent it in Express applications. Now, let's focus on an equally important aspect: monitoring and responding to SSRF incidents . Even with robust prevention measures, it's essential to detect and respond to potential attacks quickly. Let's dive in! 🔍

The Importance of Monitoring

Monitoring is a critical component of a comprehensive security strategy. It allows you to: Detect potential SSRF attacks in real-time Collect data for forensic analysis Improve your security measures based on attack patterns Respond quickly to minimize damage Let's explore how to set up effective monitoring for SSRF vulnerabilities in Express applications.

Setting Up Request Logging

The first step in monitoring is to set up comprehensive request logging. This allows you to track and analyze all incoming requests, making it easier to detect suspicious activity: TypeScriptimport express from 'express'; import morgan from 'morgan'; import fs from 'fs'; import path from 'path'; const app = express(); // Create a write stream for access logs const accessLogStream = fs.createWriteStream( path.join(__dirname, 'access.log'), { flags: 'a' } ); // Set up request logging app.use(morgan('combined', { stream: accessLogStream })); // Example route app.get('/', (req, res) => { res.send('Hello, world!'); }); app.listen(3000, () => { console.log('Server running on port 3000'); }); In this example, we use the morgan middleware to log all HTTP requests to a file. The 'combined' format includes information such as the IP address, request method, URL, status code, and user agent.

Advanced SSRF Detection

To detect potential SSRF attacks, we need to implement more sophisticated monitoring. Let's create a middleware that specifically looks for suspicious URL patterns: TypeScript import express from 'express'; import { URL } from 'url'; const app = express(); app.use(express.json()); // SSRF detection middleware const ssrfDetectionMiddleware = (req: express.Request, res: express.Response, next: express.NextFunction) => {// Extract URL from request body, query, or params const url = req.body.url || req.query.url || ''; if (url && typeof url === 'string') {try {const parsedUrl = new URL(url); // Check for suspicious patterns const suspiciousPatterns = ['127.0.0.1','localhost','internal','169.254.169.254', // Cloud metadata service'file:','dict:','gopher:','10.','172.16.','192.168.']; const isSuspicious = suspiciousPatterns.some(pattern => parsedUrl.hostname.includes(pattern) || url.includes(pattern)); if (isSuspicious) {// Log the suspicious request console.warn(`POTENTIAL SSRF ATTACK: ${req.ip} tried to access ${url}`); // You could also trigger an alert or save to a security log alertAdmin('Potential SSRF Attack', `IP: ${req.ip}, URL: ${url}`);}} catch (error) {// URL parsing failed, but we'll continue processing the request}} next();}; // Apply the middleware app.use(ssrfDetectionMiddleware); // Example route app.post('/fetch-url', async (req, res) => {// Your secure URL fetching logic here res.json({ success: true });}); function alertAdmin(subject: string, message: string) {// Implementation of alerting mechanism (email, SMS, etc.) console.log(`ALERT: ${subject} - ${message}`);} app.listen(3000, () => {console.log('Server running on port 3000');}); This middleware checks for suspicious URL patterns that might indicate an SSRF attack attempt. When detected, it logs the incident and triggers an alert.

Join the 1M+ learners on CodeSignal

Be a part of our community of 1M+ users who develop and demonstrate their skills on CodeSignal

TypeScript

import express from 'express';
import nodemailer from 'nodemailer';

const app = express();
app.use(express.json());

// Configure email transporter
const transporter = nodemailer.createTransport({
  service: 'gmail',
  auth: {
    user: process.env.EMAIL_USER || 'your-email@gmail.com',
    pass: process.env.EMAIL_PASSWORD || 'your-email-password'
  }
});

// Function to send alert emails
function alertAdmin(subject: string, message: string) {
  const mailOptions = {
    from: process.env.EMAIL_USER || 'your-email@gmail.com',
    to: process.env.ADMIN_EMAIL || 'admin@example.com',
    subject,
    text: message
  };

  transporter.sendMail(mailOptions, (error, info) => {
    if (error) {
      console.error(`Error sending email: ${error}`);
    } else {
      console.log(`Email sent: ${info.response}`);
    }
  });
}

// Example route to report security incidents
app.post('/report-incident', (req, res) => {
  const { incident } = req.body;
  
  if (!incident) {
    return res.status(400).json({ error: 'Incident details required' });
  }
  
  // Log the incident
  console.warn(`Security incident reported: ${incident}`);
  
  // Alert administrators
  alertAdmin('SSRF Incident Reported', `Details: ${incident}`);
  
  res.json({ success: true });
});

app.listen(3000, () => {
  console.log('Server running on port 3000');
});

TypeScript

class SSRFIncidentHandler {
  // Record of incidents
  private incidents: {
    timestamp: Date;
    ip: string;
    url: string;
    resolved: boolean;
  }[] = [];
  
  // Log a new incident
  logIncident(ip: string, url: string) {
    const incident = {
      timestamp: new Date(),
      ip,
      url,
      resolved: false
    };
    
    this.incidents.push(incident);
    console.warn(`[${incident.timestamp.toISOString()}] SSRF Attempt: ${ip} -> ${url}`);
    
    // Alert appropriate personnel
    this.alertTeam(incident);
    
    // Implement mitigation measures
    this.mitigate(ip);
    
    return incident;
  }
  
  // Alert security team
  private alertTeam(incident: any) {
    // In a real app, this would send emails, SMS, or integrate with a security platform
    console.log(`SECURITY ALERT: SSRF attempt from ${incident.ip} targeting ${incident.url}`);
  }
  
  // Implement mitigation measures
  private mitigate(ip: string) {
    // In a real app, this might temporarily block the IP, adjust WAF rules, etc.
    console.log(`Mitigation: Temporarily blocking requests from ${ip}`);
  }
  
  // Get all recorded incidents
  getIncidents(resolved?: boolean) {
    if (resolved === undefined) {
      return this.incidents;
    }
    return this.incidents.filter(incident => incident.resolved === resolved);
  }
  
  // Mark an incident as resolved
  resolveIncident(index: number) {
    if (this.incidents[index]) {
      this.incidents[index].resolved = true;
      return true;
    }
    return false;
  }
}

// Example usage in an Express app
const incidentHandler = new SSRFIncidentHandler();

app.use((req, res, next) => {
  const url = req.body?.url || req.query?.url;
  
  if (url && isSuspiciousUrl(url)) {
    incidentHandler.logIncident(req.ip, url);
    return res.status(403).json({ error: 'Access denied' });
  }
  
  next();
});

function isSuspiciousUrl(url: string): boolean {
  // Implement your SSRF detection logic here
  return url.includes('internal') || url.includes('localhost');
}

// Admin endpoint to view incidents
app.get('/admin/incidents', (req, res) => {
  // In a real app, this would require authentication
  const resolved = req.query.resolved === 'true' ? true : 
                  req.query.resolved === 'false' ? false : undefined;
  
  res.json(incidentHandler.getIncidents(resolved));
});

Monitoring and Responding to SSRF Incidents

Introduction

The Importance of Monitoring

Setting Up Request Logging

Advanced SSRF Detection

Join the 1M+ learners on CodeSignal

Setting Up Alerts

Incident Response Plan

Conclusion