Understanding SSRF Vulnerabilities

Introduction to SSRF

Welcome to the very first lesson of the " Server-Side Request Forgery (SSRF) Prevention in FastAPI " course! In this lesson, we will explore Server-Side Request Forgery (SSRF), a critical security vulnerability that can affect web applications. SSRF occurs when an attacker tricks a server into making unauthorized requests on their behalf. This can lead to the exposure of sensitive information or unauthorized actions within a network. Understanding SSRF is crucial for building secure applications and protecting against potential threats. Let's dive into the mechanics of SSRF to see how these vulnerabilities occur. 🚀

Understanding SSRF

To understand SSRF, it's important to differentiate between client-side and server-side requests. In a typical web application, client-side requests are made by the user's browser, while server-side requests are made by the server itself. SSRF vulnerabilities occur when an attacker manipulates server-side requests to access unauthorized resources. Imagine a scenario in which a web application allows users to input a URL to fetch data. If the application doesn't properly validate the input, an attacker could input a URL pointing to an internal resource, such as a private server. Internal resources typically include services like internal dashboards, internal APIs, or even databases that are not exposed to the public internet. These systems are usually protected by network-level restrictions like firewalls or NAT, meaning users on the internet shouldn't be able to access them directly. However, because the server itself is inside the protected network, it can access these systems. By leveraging SSRF, attackers exploit this trust boundary and trick the server into making requests to sensitive endpoints on their behalf — essentially bypassing external access restrictions.

SSRF Attack Patterns

SSRF attacks can take several forms, depending on the target and the attacker's goals: Internal Network Scanning: Attackers use SSRF to map out internal networks by sending requests to various IP addresses and ports. Cloud Metadata Service Attacks: In cloud environments, attackers target metadata services (like AWS Instance Metadata Service) to obtain sensitive information such as access keys. Local File Access: Using protocols like file://, attackers might attempt to read local files on the server. Service-Specific Exploits: Attackers target internal services that might have weak authentication when accessed from within the network. Here's a basic example of an SSRF vulnerability: Pythonimport requests # Example of a vulnerable server-side request def fetch_data(url: str) -> None: # Server makes a request to the provided URL without validation print(f'Fetching data from: {url}') response = requests.get(url) print(response.text) user_input = 'http://internal-server.local/data' fetch_data(user_input)

Join the 1M+ learners on CodeSignal

Be a part of our community of 1M+ users who develop and demonstrate their skills on CodeSignal

Identifying Internal IPs and Localhost

A naive approach to SSRF detection is to check if the URL contains internal IP addresses or localhost references as substrings. However, this can lead to false positives. For example, the domain not-localhost.com would be incorrectly flagged as dangerous, even though it is a public domain.

A more robust approach is to parse the URL and check the actual hostname against known internal addresses and private IP ranges. Additionally, it's important to check if any query parameter values themselves are internal IPs, hostnames, or URLs pointing to internal resources.

Python

import ipaddress
import logging
from urllib.parse import urlparse, parse_qs

# Check for internal IPs and localhost variants using proper IP classification
def is_ssrf_vulnerable(url: str) -> bool:
    localhost_hostnames = ['127.0.0.1', 'localhost', '0.0.0.0', '::1']

    def is_dangerous_host(host: str) -> bool:
        if host in localhost_hostnames:
            return True
        
        # Use ipaddress module for proper IP classification
        try:
            ip = ipaddress.ip_address(host)
            # Check for private, loopback, link-local, multicast, reserved, or unspecified addresses
            if (ip.is_private or ip.is_loopback or ip.is_link_local or 
                ip.is_multicast or ip.is_reserved or ip.is_unspecified):
                return True
        except ValueError:
            # Not a valid IP address, check if it's a dangerous hostname
            if host.lower() in ['localhost', 'local']:
                return True
        return False

    try:
        parsed = urlparse(url)
        hostname = parsed.hostname or parsed.netloc

        # Check for localhost variants and private IPs in the main hostname
        if is_dangerous_host(hostname):
            return True

        # Check for dangerous patterns in query parameter values
        query_params = parse_qs(parsed.query)
        for values in query_params.values():
            for value in values:
                # If value looks like a host or IP, check it
                if is_dangerous_host(value):
                    return True

                # If value is a URL, check its hostname
                try:
                    param_url = urlparse(value)
                    if param_url.hostname and is_dangerous_host(param_url.hostname):
                        return True
                except (ValueError, TypeError) as e:
                    # Not a URL, skip
                    logging.debug(f"Failed to parse parameter URL: {e}")

        return False
    except (ValueError, TypeError) as e:
        logging.warning(f"Failed to parse URL for SSRF check: {e}")
        return False

url = 'http://127.0.0.1/admin'
print(f'Is SSRF Vulnerable: {is_ssrf_vulnerable(url)}')

import ipaddress
import logging
from urllib.parse import urlparse, parse_qs

# Check for internal IPs and localhost variants using proper IP classification
def is_ssrf_vulnerable(url: str) -> bool:
    localhost_hostnames = ['127.0.0.1', 'localhost', '0.0.0.0', '::1']

    def is_dangerous_host(host: str) -> bool:
        if host in localhost_hostnames:
            return True
        
        # Use ipaddress module for proper IP classification
        try:
            ip = ipaddress.ip_address(host)
            # Check for private, loopback, link-local, multicast, reserved, or unspecified addresses
            if (ip.is_private or ip.is_loopback or ip.is_link_local or 
                ip.is_multicast or ip.is_reserved or ip.is_unspecified):
                return True
        except ValueError:
            # Not a valid IP address, check if it's a dangerous hostname
            if host.lower() in ['localhost', 'local']:
                return True
        return False

    try:
        parsed = urlparse(url)
        hostname = parsed.hostname or parsed.netloc

        # Check for localhost variants and private IPs in the main hostname
        if is_dangerous_host(hostname):
            return True

        # Check for dangerous patterns in query parameter values
        query_params = parse_qs(parsed.query)
        for values in query_params.values():
            for value in values:
                # If value looks like a host or IP, check it
                if is_dangerous_host(value):
                    return True

                # If value is a URL, check its hostname
                try:
                    param_url = urlparse(value)
                    if param_url.hostname and is_dangerous_host(param_url.hostname):
                        return True
                except (ValueError, TypeError) as e:
                    # Not a URL, skip
                    logging.debug(f"Failed to parse parameter URL: {e}")

        return False
    except (ValueError, TypeError) as e:
        logging.warning(f"Failed to parse URL for SSRF check: {e}")
        return False

url = 'http://127.0.0.1/admin'
print(f'Is SSRF Vulnerable: {is_ssrf_vulnerable(url)}')

Note: Always parse and check the hostname, not just substrings, to avoid false positives in SSRF detection. Also, consider checking query parameter values, as attackers may try to smuggle internal addresses there.

Introduction to SSRF