Introduction to SSRF

About This Course

This course teaches SSRF prevention techniques for Java web applications, progressing from core concepts to Spring Boot implementation: Unit 1 : Core SSRF concepts using plain Java - you'll learn to detect and understand SSRF vulnerabilities using fundamental Java APIs Units 2-4 : Spring Boot implementation - you'll apply these concepts in modern Spring Boot applications with framework-specific features We start with plain Java to ensure you understand the underlying security principles before leveraging Spring Boot's conveniences. This foundation will help you secure any Java web application, regardless of the framework.

Introduction to SSRF

Welcome to the very first lesson of the Server-Side Request Forgery (SSRF) Prevention in Java course! In this lesson, we will explore Server-Side Request Forgery (SSRF), a critical security vulnerability that can affect web applications. SSRF occurs when an attacker tricks a server into making unauthorized requests on their behalf. This can lead to the exposure of sensitive information or unauthorized actions within a network. Understanding SSRF is crucial for building secure applications and protecting against potential threats. Let's dive into the mechanics of SSRF to see how these vulnerabilities occur. 🚀

Understanding SSRF

To understand SSRF, it's important to differentiate between client-side and server-side requests. In a typical web application, client-side requests are made by the user's browser, while server-side requests are made by the server itself. SSRF vulnerabilities occur when an attacker manipulates server-side requests to access unauthorized resources. Imagine a scenario in which a web application allows users to input a URL to fetch data. If the application doesn't properly validate the input, an attacker could input a URL pointing to an internal resource, such as a private server. Internal resources typically include services like internal dashboards, internal APIs, or even databases that are not exposed to the public internet. These systems are usually protected by network-level restrictions like firewalls or NAT, meaning users on the internet shouldn't be able to access them directly. However, because the server itself is inside the protected network, it can access these systems. By leveraging SSRF, attackers exploit this trust boundary and trick the server into making requests to sensitive endpoints on their behalf — essentially bypassing external access restrictions.

Join the 1M+ learners on CodeSignal

Be a part of our community of 1M+ users who develop and demonstrate their skills on CodeSignal

SSRF Attack Flow

The following diagram illustrates how an SSRF attack bypasses network security boundaries:

┌──────────────┐
│   Attacker   │
└──────┬───────┘
       │ 1. Malicious URL
       │    (e.g., http://internal-server/admin)
       ▼
┌──────────────────────┐
│   Web Application    │
│   (Public Server)    │
└──────┬───────────────┘
       │ 2. Server makes request
       │    on behalf of attacker
       ▼
┌─────────────────────────────────┐
│   Firewall/Network Boundary     │
└─────────────────────────────────┘
       │ 3. Request passes through
       │    (server is trusted)
       ▼
┌──────────────────────┐
│  Internal Resource   │
│  (Database, Admin,   │
│   Metadata Service)  │
└──────────────────────┘

┌──────────────┐
│   Attacker   │
└──────┬───────┘
       │ 1. Malicious URL
       │    (e.g., http://internal-server/admin)
       ▼
┌──────────────────────┐
│   Web Application    │
│   (Public Server)    │
└──────┬───────────────┘
       │ 2. Server makes request
       │    on behalf of attacker
       ▼
┌─────────────────────────────────┐
│   Firewall/Network Boundary     │
└─────────────────────────────────┘
       │ 3. Request passes through
       │    (server is trusted)
       ▼
┌──────────────────────┐
│  Internal Resource   │
│  (Database, Admin,   │
│   Metadata Service)  │
└──────────────────────┘

In this attack flow:

The attacker provides a malicious URL pointing to an internal resource
The vulnerable application makes a server-side request to that URL without proper validation
The request passes through network security because it originates from the trusted server
The attacker gains access to internal resources that should be protected

Identifying Internal IPs and Localhost

A naive approach to SSRF detection is to check if the URL contains internal IP addresses or localhost references as substrings. However, this can lead to false positives. For example, the domain not-localhost.com would be incorrectly flagged as dangerous, even though it is a public domain.

A more robust approach is to parse the URL and check the actual hostname against known internal addresses and private IP ranges. Additionally, it's important to check if any query parameter values themselves are internal IPs, hostnames, or URLs pointing to internal resources.

Here is an example in Java:

Java

import java.net.URL;
import java.net.MalformedURLException;
import java.util.regex.Pattern;
import java.util.regex.Matcher;
import java.util.Arrays;
import java.util.List;

public class SSRFDetection {

    private static final List<String> LOCALHOST_HOSTNAMES = Arrays.asList(
        "127.0.0.1", "localhost", "0.0.0.0", "::1"
    );

    private static final Pattern[] PRIVATE_IP_PATTERNS = new Pattern[] {
        Pattern.compile("^10\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}$"),
        Pattern.compile("^192\\.168\\.\\d{1,3}\\.\\d{1,3}$"),
        Pattern.compile("^172\\.(1[6-9]|2[0-9]|3[0-1])\\.\\d{1,3}\\.\\d{1,3}$")
    };

    public static boolean isDangerousHost(String host) {
        if (LOCALHOST_HOSTNAMES.contains(host)) {
            return true;
        }
        for (Pattern pattern : PRIVATE_IP_PATTERNS) {
            Matcher matcher = pattern.matcher(host);
            if (matcher.matches()) {
                return true;
            }
        }
        return false;
    }

    public static boolean isSSRFVulnerable(String urlString) {
        try {
            URL url = new URL(urlString);
            String hostname = url.getHost();

            // Check for localhost variants and private IPs in the main hostname
            if (isDangerousHost(hostname)) {
                return true;
            }

            // Check for dangerous patterns in query parameter values
            String query = url.getQuery();
            if (query != null) {
                String[] params = query.split("&");
                for (String param : params) {
                    String[] keyValue = param.split("=", 2);
                    if (keyValue.length == 2) {
                        String value = keyValue[1];
                        // If value looks like a host or IP, check it
                        if (isDangerousHost(value)) {
                            return true;
                        }
                        // If value is a URL, check its hostname
                        try {
                            URL paramUrl = new URL(value);
                            if (isDangerousHost(paramUrl.getHost())) {
                                return true;
                            }
                        } catch (MalformedURLException e) {
                            // Not a URL, skip
                        }
                    }
                }
            }
            return false;
        } catch (MalformedURLException e) {
            return false;
        }
    }

    public static void main(String[] args) {
        String url = "http://127.0.0.1/admin";
        System.out.println("Is SSRF Vulnerable: " + isSSRFVulnerable(url));
    }
}

import java.net.URL;
import java.net.MalformedURLException;
import java.util.regex.Pattern;
import java.util.regex.Matcher;
import java.util.Arrays;
import java.util.List;

public class SSRFDetection {

    private static final List<String> LOCALHOST_HOSTNAMES = Arrays.asList(
        "127.0.0.1", "localhost", "0.0.0.0", "::1"
    );

    private static final Pattern[] PRIVATE_IP_PATTERNS = new Pattern[] {
        Pattern.compile("^10\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}$"),
        Pattern.compile("^192\\.168\\.\\d{1,3}\\.\\d{1,3}$"),
        Pattern.compile("^172\\.(1[6-9]|2[0-9]|3[0-1])\\.\\d{1,3}\\.\\d{1,3}$")
    };

    public static boolean isDangerousHost(String host) {
        if (LOCALHOST_HOSTNAMES.contains(host)) {
            return true;
        }
        for (Pattern pattern : PRIVATE_IP_PATTERNS) {
            Matcher matcher = pattern.matcher(host);
            if (matcher.matches()) {
                return true;
            }
        }
        return false;
    }

    public static boolean isSSRFVulnerable(String urlString) {
        try {
            URL url = new URL(urlString);
            String hostname = url.getHost();

            // Check for localhost variants and private IPs in the main hostname
            if (isDangerousHost(hostname)) {
                return true;
            }

            // Check for dangerous patterns in query parameter values
            String query = url.getQuery();
            if (query != null) {
                String[] params = query.split("&");
                for (String param : params) {
                    String[] keyValue = param.split("=", 2);
                    if (keyValue.length == 2) {
                        String value = keyValue[1];
                        // If value looks like a host or IP, check it
                        if (isDangerousHost(value)) {
                            return true;
                        }
                        // If value is a URL, check its hostname
                        try {
                            URL paramUrl = new URL(value);
                            if (isDangerousHost(paramUrl.getHost())) {
                                return true;
                            }
                        } catch (MalformedURLException e) {
                            // Not a URL, skip
                        }
                    }
                }
            }
            return false;
        } catch (MalformedURLException e) {
            return false;
        }
    }

    public static void main(String[] args) {
        String url = "http://127.0.0.1/admin";
        System.out.println("Is SSRF Vulnerable: " + isSSRFVulnerable(url));
    }
}

Note: Always parse and check the hostname, not just substrings, to avoid false positives in SSRF detection. Also, consider checking query parameter values, as attackers may try to smuggle internal addresses there.

Note on URL vs URI: This example uses java.net.URL for simplicity and readability. In production code, consider using java.net.URI instead, as it provides better RFC compliance and doesn't perform DNS resolution during construction (which could itself be an SSRF vector). The URI class is more suitable for validation purposes before making actual HTTP requests.

About This Course