Understanding SSRF Vulnerabilities

Introduction to SSRF

Welcome to the very first lesson of the " Server-Side Request Forgery (SSRF) Prevention in FastAPI " course! In this lesson, we will explore Server-Side Request Forgery (SSRF), a critical security vulnerability that can affect web applications. SSRF occurs when an attacker tricks a server into making unauthorized requests on their behalf. This can lead to the exposure of sensitive information or unauthorized actions within a network. Understanding SSRF is crucial for building secure applications and protecting against potential threats. Let's dive into the mechanics of SSRF to see how these vulnerabilities occur. 🚀

Understanding SSRF

To understand SSRF, it's important to differentiate between client-side and server-side requests. In a typical web application, client-side requests are made by the user's browser, while server-side requests are made by the server itself. SSRF vulnerabilities occur when an attacker manipulates server-side requests to access unauthorized resources. Imagine a scenario in which a web application allows users to input a URL to fetch data. If the application doesn't properly validate the input, an attacker could input a URL pointing to an internal resource, such as a private server. Internal resources typically include services like internal dashboards, internal APIs, or even databases that are not exposed to the public internet. These systems are usually protected by network-level restrictions like firewalls or NAT, meaning users on the internet shouldn't be able to access them directly. However, because the server itself is inside the protected network, it can access these systems. By leveraging SSRF, attackers exploit this trust boundary and trick the server into making requests to sensitive endpoints on their behalf — essentially bypassing external access restrictions.

SSRF Attack Patterns

SSRF attacks can take several forms, depending on the target and the attacker's goals: Internal Network Scanning: Attackers use SSRF to map out internal networks by sending requests to various IP addresses and ports. Cloud Metadata Service Attacks: In cloud environments, attackers target metadata services (like AWS Instance Metadata Service) to obtain sensitive information such as access keys. Local File Access: Using protocols like file://, attackers might attempt to read local files on the server. Service-Specific Exploits: Attackers target internal services that might have weak authentication when accessed from within the network. Here's a basic example of an SSRF vulnerability: Pythonimport requests # Example of a vulnerable server-side request def fetch_data(url: str) -> None: # Server makes a request to the provided URL without validation print(f'Fetching data from: {url}') response = requests.get(url) print(response.text) user_input = 'http://internal-server.local/data' fetch_data(user_input)

Join the 1M+ learners on CodeSignal

Be a part of our community of 1M+ users who develop and demonstrate their skills on CodeSignal

Shell

# Example of targeting cloud metadata service
curl http://vulnerable-app.com/fetch?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/

# Example of targeting cloud metadata service
curl http://vulnerable-app.com/fetch?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/

Python

import ipaddress
import logging
from urllib.parse import urlparse, parse_qs

# Check for internal IPs and localhost variants using proper IP classification
def is_ssrf_vulnerable(url: str) -> bool:
    localhost_hostnames = ['127.0.0.1', 'localhost', '0.0.0.0', '::1']

    def is_dangerous_host(host: str) -> bool:
        if host in localhost_hostnames:
            return True
        
        # Use ipaddress module for proper IP classification
        try:
            ip = ipaddress.ip_address(host)
            # Check for private, loopback, link-local, multicast, reserved, or unspecified addresses
            if (ip.is_private or ip.is_loopback or ip.is_link_local or 
                ip.is_multicast or ip.is_reserved or ip.is_unspecified):
                return True
        except ValueError:
            # Not a valid IP address, check if it's a dangerous hostname
            if host.lower() in ['localhost', 'local']:
                return True
        return False

    try:
        parsed = urlparse(url)
        hostname = parsed.hostname or parsed.netloc

        # Check for localhost variants and private IPs in the main hostname
        if is_dangerous_host(hostname):
            return True

        # Check for dangerous patterns in query parameter values
        query_params = parse_qs(parsed.query)
        for values in query_params.values():
            for value in values:
                # If value looks like a host or IP, check it
                if is_dangerous_host(value):
                    return True

                # If value is a URL, check its hostname
                try:
                    param_url = urlparse(value)
                    if param_url.hostname and is_dangerous_host(param_url.hostname):
                        return True
                except (ValueError, TypeError) as e:
                    # Not a URL, skip
                    logging.debug(f"Failed to parse parameter URL: {e}")

        return False
    except (ValueError, TypeError) as e:
        logging.warning(f"Failed to parse URL for SSRF check: {e}")
        return False

url = 'http://127.0.0.1/admin'
print(f'Is SSRF Vulnerable: {is_ssrf_vulnerable(url)}')

import ipaddress
import logging
from urllib.parse import urlparse, parse_qs

# Check for internal IPs and localhost variants using proper IP classification
def is_ssrf_vulnerable(url: str) -> bool:
    localhost_hostnames = ['127.0.0.1', 'localhost', '0.0.0.0', '::1']

    def is_dangerous_host(host: str) -> bool:
        if host in localhost_hostnames:
            return True
        
        # Use ipaddress module for proper IP classification
        try:
            ip = ipaddress.ip_address(host)
            # Check for private, loopback, link-local, multicast, reserved, or unspecified addresses
            if (ip.is_private or ip.is_loopback or ip.is_link_local or 
                ip.is_multicast or ip.is_reserved or ip.is_unspecified):
                return True
        except ValueError:
            # Not a valid IP address, check if it's a dangerous hostname
            if host.lower() in ['localhost', 'local']:
                return True
        return False

    try:
        parsed = urlparse(url)
        hostname = parsed.hostname or parsed.netloc

        # Check for localhost variants and private IPs in the main hostname
        if is_dangerous_host(hostname):
            return True

        # Check for dangerous patterns in query parameter values
        query_params = parse_qs(parsed.query)
        for values in query_params.values():
            for value in values:
                # If value looks like a host or IP, check it
                if is_dangerous_host(value):
                    return True

                # If value is a URL, check its hostname
                try:
                    param_url = urlparse(value)
                    if param_url.hostname and is_dangerous_host(param_url.hostname):
                        return True
                except (ValueError, TypeError) as e:
                    # Not a URL, skip
                    logging.debug(f"Failed to parse parameter URL: {e}")

        return False
    except (ValueError, TypeError) as e:
        logging.warning(f"Failed to parse URL for SSRF check: {e}")
        return False

url = 'http://127.0.0.1/admin'
print(f'Is SSRF Vulnerable: {is_ssrf_vulnerable(url)}')

Python

# Check for non-HTTP schemes that could be exploited
def has_unsafe_scheme(url: str) -> bool:
    unsafe_schemes = ['file://', 'gopher://', 'data:', 'dict://', 'ftp://']
    lower_url = url.lower()
    return any(lower_url.startswith(scheme) for scheme in unsafe_schemes)

unsafe_url = 'file:///etc/passwd'
print(f'Has Unsafe Scheme: {has_unsafe_scheme(unsafe_url)}')

# Check for non-HTTP schemes that could be exploited
def has_unsafe_scheme(url: str) -> bool:
    unsafe_schemes = ['file://', 'gopher://', 'data:', 'dict://', 'ftp://']
    lower_url = url.lower()
    return any(lower_url.startswith(scheme) for scheme in unsafe_schemes)

unsafe_url = 'file:///etc/passwd'
print(f'Has Unsafe Scheme: {has_unsafe_scheme(unsafe_url)}')

Python

from urllib.parse import urlparse

# Validate URL format and domain
def is_valid_and_safe_url(url: str) -> bool:
    try:
        parsed = urlparse(url)
        
        # Check for valid HTTP/HTTPS scheme
        if parsed.scheme not in ['http', 'https']:
            return False
        
        # Check for valid netloc (hostname and optional port)
        if not parsed.netloc:
            return False
        
        # Check for unsafe targets
        if is_ssrf_vulnerable(url) or has_unsafe_scheme(url):
            return False
        
        # Additional checks could be added here
        return True
    except:
        return False

from urllib.parse import urlparse

# Validate URL format and domain
def is_valid_and_safe_url(url: str) -> bool:
    try:
        parsed = urlparse(url)
        
        # Check for valid HTTP/HTTPS scheme
        if parsed.scheme not in ['http', 'https']:
            return False
        
        # Check for valid netloc (hostname and optional port)
        if not parsed.netloc:
            return False
        
        # Check for unsafe targets
        if is_ssrf_vulnerable(url) or has_unsafe_scheme(url):
            return False
        
        # Additional checks could be added here
        return True
    except:
        return False

Shell

# Example of targeting cloud metadata service
curl http://vulnerable-app.com/fetch?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/

Python

import ipaddress
import logging
from urllib.parse import urlparse, parse_qs

# Check for internal IPs and localhost variants using proper IP classification
def is_ssrf_vulnerable(url: str) -> bool:
    localhost_hostnames = ['127.0.0.1', 'localhost', '0.0.0.0', '::1']

    def is_dangerous_host(host: str) -> bool:
        if host in localhost_hostnames:
            return True
        
        # Use ipaddress module for proper IP classification
        try:
            ip = ipaddress.ip_address(host)
            # Check for private, loopback, link-local, multicast, reserved, or unspecified addresses
            if (ip.is_private or ip.is_loopback or ip.is_link_local or 
                ip.is_multicast or ip.is_reserved or ip.is_unspecified):
                return True
        except ValueError:
            # Not a valid IP address, check if it's a dangerous hostname
            if host.lower() in ['localhost', 'local']:
                return True
        return False

    try:
        parsed = urlparse(url)
        hostname = parsed.hostname or parsed.netloc

        # Check for localhost variants and private IPs in the main hostname
        if is_dangerous_host(hostname):
            return True

        # Check for dangerous patterns in query parameter values
        query_params = parse_qs(parsed.query)
        for values in query_params.values():
            for value in values:
                # If value looks like a host or IP, check it
                if is_dangerous_host(value):
                    return True

                # If value is a URL, check its hostname
                try:
                    param_url = urlparse(value)
                    if param_url.hostname and is_dangerous_host(param_url.hostname):
                        return True
                except (ValueError, TypeError) as e:
                    # Not a URL, skip
                    logging.debug(f"Failed to parse parameter URL: {e}")

        return False
    except (ValueError, TypeError) as e:
        logging.warning(f"Failed to parse URL for SSRF check: {e}")
        return False

url = 'http://127.0.0.1/admin'
print(f'Is SSRF Vulnerable: {is_ssrf_vulnerable(url)}')

Python

# Check for non-HTTP schemes that could be exploited
def has_unsafe_scheme(url: str) -> bool:
    unsafe_schemes = ['file://', 'gopher://', 'data:', 'dict://', 'ftp://']
    lower_url = url.lower()
    return any(lower_url.startswith(scheme) for scheme in unsafe_schemes)

unsafe_url = 'file:///etc/passwd'
print(f'Has Unsafe Scheme: {has_unsafe_scheme(unsafe_url)}')

Python

from urllib.parse import urlparse

# Validate URL format and domain
def is_valid_and_safe_url(url: str) -> bool:
    try:
        parsed = urlparse(url)
        
        # Check for valid HTTP/HTTPS scheme
        if parsed.scheme not in ['http', 'https']:
            return False
        
        # Check for valid netloc (hostname and optional port)
        if not parsed.netloc:
            return False
        
        # Check for unsafe targets
        if is_ssrf_vulnerable(url) or has_unsafe_scheme(url):
            return False
        
        # Additional checks could be added here
        return True
    except:
        return False

Introduction to SSRF

Understanding SSRF

SSRF Attack Patterns

Join the 1M+ learners on CodeSignal

Common SSRF Targets

SSRF Detection Techniques

Identifying Internal IPs and Localhost

Detecting Non-HTTP Schemes

Validating URL Format and Domain

Conclusion