Preventing SSRF in Express

Introduction

Welcome back! In the previous lesson, we explored the concept of Server-Side Request Forgery (SSRF) vulnerabilities and how to detect them. Now, we'll focus on preventing SSRF in Express applications. By the end of this lesson, you'll understand how to secure your Express applications against SSRF attacks, ensuring a safer web environment. Let's dive in! 🌟

Understanding SSRF in Express

Express is a popular web application framework for Node.js, known for its simplicity and flexibility in handling HTTP requests. However, this flexibility can sometimes lead to vulnerabilities if not handled properly. SSRF vulnerabilities in Express often arise when user input is not validated, allowing attackers to manipulate server-side requests. When an Express application receives a request, it processes the input and may make further requests to external resources. If this input is not properly validated, an attacker can craft a request that tricks the server into making unintended requests, potentially accessing sensitive data or services.

The Vulnerable Code

Let's examine a piece of code that demonstrates how SSRF vulnerabilities can occur in an Express application: TypeScript import express from 'express'; import axios from 'axios'; const app = express(); app.use(express.json()); app.post('/fetch-url', async (req, res) => {const { url } = req.body; try {const response = await axios.get(url); res.json({ data: response.data });} catch (error: any) {res.status(500).json({ error: 'Failed to fetch URL' });}}); In this code, the application accepts a URL from the user and fetches data from it using axios . However, there's no validation to ensure the URL is safe or trusted. This lack of validation can lead to SSRF vulnerabilities, as attackers can provide malicious URL s to exploit the server.

Exploiting the Vulnerability

An attacker can exploit this vulnerability by providing a malicious URL to the /fetch-url endpoint. Here's an example of how an attack might be performed: Shell # Attacker crafts a request to the vulnerable endpoint curl -X POST http://localhost:3000/fetch-url -H "Content-Type: application/json" -d '{"url": "http://internal-service.local"}' In this example, the attacker sends a POST request to the /fetch-url endpoint with a URL pointing to an internal service. If the application does not validate the URL, it may inadvertently access internal resources, leading to potential data breaches or unauthorized actions. This is especially dangerous in environments like cloud platforms (AWS, Azure, GCP), where internal endpoints such as metadata services are exposed only to internal IPs. By exploiting SSRF in such cases, an attacker can retrieve sensitive data like instance credentials or configuration tokens, which may then be used to escalate privileges or access cloud APIs directly.

Join the 1M+ learners on CodeSignal

Be a part of our community of 1M+ users who develop and demonstrate their skills on CodeSignal

URL Whitelisting

Next, we'll implement URL whitelisting to restrict requests to trusted domains only:

TypeScript

import express from 'express';
import axios from 'axios';
import { URL } from 'url';

const app = express();
app.use(express.json());

// List of allowed domains
const ALLOWED_DOMAINS = ['trusted-domain.com', 'api.trusted-domain.com'];

// Example of SSRF prevention
app.post('/fetch-url', async (req, res) => {
  const { url } = req.body;

  // Basic validation
  if (!url || typeof url !== 'string') {
    return res.status(400).json({ error: 'Invalid URL format' });
  }

  try {
    // Parse the URL to validate its components
    const parsedUrl = new URL(url);
    
    // Ensure only HTTP/HTTPS protocols are used
    if (parsedUrl.protocol !== 'http:' && parsedUrl.protocol !== 'https:') {
      return res.status(400).json({ error: 'Only HTTP/HTTPS protocols are allowed' });
    }
    
    // Check if domain is in our whitelist
    const isDomainAllowed = ALLOWED_DOMAINS.some(domain => 
      parsedUrl.hostname === domain || parsedUrl.hostname.endsWith(`.${domain}`)
    );
    
    if (!isDomainAllowed) {
      return res.status(400).json({ error: 'Domain not allowed' });
    }

    // Proceed with the request to the validated URL
    const response = await axios.get(url);
    res.json({ data: response.data });
  } catch (error) {
    if (error instanceof TypeError) {
      return res.status(400).json({ error: 'Invalid URL' });
    }
    res.status(500).json({ error: 'Failed to fetch URL' });
  }
});

app.listen(3000, () => {
  console.log('Server running on port 3000');
});

import express from 'express';
import axios from 'axios';
import { URL } from 'url';

const app = express();
app.use(express.json());

// List of allowed domains
const ALLOWED_DOMAINS = ['trusted-domain.com', 'api.trusted-domain.com'];

// Example of SSRF prevention
app.post('/fetch-url', async (req, res) => {
  const { url } = req.body;

  // Basic validation
  if (!url || typeof url !== 'string') {
    return res.status(400).json({ error: 'Invalid URL format' });
  }

  try {
    // Parse the URL to validate its components
    const parsedUrl = new URL(url);
    
    // Ensure only HTTP/HTTPS protocols are used
    if (parsedUrl.protocol !== 'http:' && parsedUrl.protocol !== 'https:') {
      return res.status(400).json({ error: 'Only HTTP/HTTPS protocols are allowed' });
    }
    
    // Check if domain is in our whitelist
    const isDomainAllowed = ALLOWED_DOMAINS.some(domain => 
      parsedUrl.hostname === domain || parsedUrl.hostname.endsWith(`.${domain}`)
    );
    
    if (!isDomainAllowed) {
      return res.status(400).json({ error: 'Domain not allowed' });
    }

    // Proceed with the request to the validated URL
    const response = await axios.get(url);
    res.json({ data: response.data });
  } catch (error) {
    if (error instanceof TypeError) {
      return res.status(400).json({ error: 'Invalid URL' });
    }
    res.status(500).json({ error: 'Failed to fetch URL' });
  }
});

app.listen(3000, () => {
  console.log('Server running on port 3000');
});

By checking if the domain is in our whitelist, we limit the scope of where requests can be made. This prevents attackers from directing the server to malicious or internal URLs.

Preventing SSRF in Express

Introduction

Understanding SSRF in Express

The Vulnerable Code

Exploiting the Vulnerability

Join the 1M+ learners on CodeSignal

Input Validation

URL Whitelisting

Using URL Object for Validation

Implementing IP Address Restrictions

Conclusion