Monitoring and Responding to SSRF Incidents

Introduction

Welcome to the third lesson of our Server-Side Request Forgery (SSRF) Prevention in Java course! We've covered what SSRF is and how to prevent it in Java web applications. Now, let's focus on an equally important aspect: monitoring and responding to SSRF incidents . Even with robust prevention measures, it's essential to detect and respond to potential attacks quickly. Let's dive in! 🔍

The Importance of Monitoring

Monitoring is a critical component of a comprehensive security strategy. It allows you to: Detect potential SSRF attacks in real time Collect data for forensic analysis Improve your security measures based on attack patterns Respond quickly to minimize damage Let's explore how to set up effective monitoring for SSRF vulnerabilities in Java web applications.

Setting Up Request Logging

The first step in monitoring is to set up comprehensive request logging. This allows you to track and analyze all incoming requests, making it easier to detect suspicious activity. In Java web applications, you can use a servlet filter to log incoming HTTP requests. Here’s an example using Java’s built-in logging framework: Java import javax.servlet.*; import javax.servlet.http.HttpServletRequest; import java.io.IOException; import java.util.logging.*; public class RequestLoggingFilter implements Filter {private static final Logger logger = Logger.getLogger(RequestLoggingFilter.class.getName()); @Override public void init(FilterConfig filterConfig) throws ServletException {try {FileHandler fileHandler = new FileHandler("access.log", true); fileHandler.setFormatter(new SimpleFormatter()); logger.addHandler(fileHandler);} catch (IOException e) {logger.warning("Failed to set up file handler for logging: " + e.getMessage());}} @Override public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {if (request instanceof HttpServletRequest) {HttpServletRequest req = (HttpServletRequest) request; logger.info(String.format("IP: %s, Method: %s, URL: %s, User-Agent: %s", req.getRemoteAddr(), req.getMethod(), req.getRequestURI(), req.getHeader("User-Agent")));} chain.doFilter(request, response);} @Override public void destroy() {// Cleanup if needed}} To enable this filter, register it in your web.xml or via annotations, depending on your Java web framework.

Join the 1M+ learners on CodeSignal

Be a part of our community of 1M+ users who develop and demonstrate their skills on CodeSignal

Advanced SSRF Detection

To detect potential SSRF attacks, you can implement a servlet filter that inspects incoming requests for suspicious URL patterns. Before we look at the implementation, let's understand what patterns are commonly targeted in SSRF attacks and why:

Private IP Ranges (RFC 1918):

10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16: These are private network ranges used in internal networks. Attackers use SSRF to access internal services that aren't exposed to the internet, such as databases, admin panels, or internal APIs.

Loopback Addresses:

127.0.0.1, localhost: These refer to the server itself. Attackers can use SSRF to access services running only on localhost (like development databases or internal management interfaces) that should never be accessible from outside.

Cloud Metadata Services:

169.254.169.254: Cloud providers (AWS, Azure, GCP) expose instance metadata at this address. Attackers can retrieve sensitive information like access credentials, API keys, and instance configurations through SSRF.

Internal Hostnames:

"internal" substring: Organizations often use naming conventions like "internal.company.com" or "service-internal" for internal-only services. Detecting "internal" as a substring helps catch attempts to access these services.

Alternative Protocols:

file://, dict://, gopher://: These protocols can be used to read local files, interact with services in unexpected ways, or perform other malicious actions beyond simple HTTP requests.

Here's how you might implement detection for these patterns in Java:

Java

import javax.servlet.*;
import javax.servlet.http.HttpServletRequest;
import java.io.IOException;
import java.util.logging.*;

public class SSRFDetectionFilter implements Filter {
    private static final Logger logger = Logger.getLogger(SSRFDetectionFilter.class.getName());

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
            throws IOException, ServletException {
        HttpServletRequest req = (HttpServletRequest) request;
        String url = req.getParameter("url");
        if (url == null && "application/json".equals(req.getContentType())) {
            // Optionally, parse JSON body for "url" field if needed
        }

        if (url != null && isSuspiciousUrl(url)) {
            logger.warning("POTENTIAL SSRF ATTACK: " + req.getRemoteAddr() + " tried to access " + url);
            alertAdmin("Potential SSRF Attack", "IP: " + req.getRemoteAddr() + ", URL: " + url);
            // Optionally, block the request or continue processing
        }

        chain.doFilter(request, response);
    }

    private boolean isSuspiciousUrl(String url) {
        String lowerUrl = url.toLowerCase();
        
        // Check for loopback addresses - access to the server itself
        if (lowerUrl.contains("127.0.0.1") || lowerUrl.contains("localhost")) {
            return true;
        }
        
        // Check for cloud metadata service - AWS/Azure/GCP credentials
        if (lowerUrl.contains("169.254.169.254")) {
            return true;
        }
        
        // Check for private network ranges - internal services
        if (lowerUrl.contains("10.") || lowerUrl.contains("172.16.") || lowerUrl.contains("192.168.")) {
            return true;
        }
        
        // Check for internal hostname patterns - internal-only services
        if (lowerUrl.contains("internal")) {
            return true;
        }
        
        // Check for dangerous protocols - file access and other exploits
        String[] dangerousProtocols = {"file:", "dict:", "gopher:", "ftp:"};
        for (String protocol : dangerousProtocols) {
            if (lowerUrl.startsWith(protocol)) {
                return true;
            }
        }
        
        return false;
    }

    private void alertAdmin(String subject, String message) {
        // Implementation of alerting mechanism (see next section)
        System.out.println("ALERT: " + subject + " - " + message);
    }
}

Important Note: This detection approach uses substring matching as a first line of defense. However, attackers may use obfuscation techniques (like URL encoding, IP address formats in decimal or hexadecimal, DNS rebinding, or redirects) to bypass these checks. For production systems, combine this with the allowlist-based validation approach from the previous lesson and consider using more sophisticated URL parsing and validation libraries.

Setting Up Alerts

Alerting is crucial for a timely response to potential security incidents. In Java, you can use the JavaMail API to send email alerts to administrators when suspicious activity is detected.

To keep credentials secure and maintain flexibility across different environments, always use environment variables for both sensitive information and configuration settings. Here's a simple example:

Java

import javax.mail.*;
import javax.mail.internet.*;
import java.util.Properties;

public class AlertService {
    private final String username = System.getenv("EMAIL_USERNAME");
    private final String password = System.getenv("EMAIL_PASSWORD");
    private final String adminEmail = System.getenv("ADMIN_EMAIL");
    private final String smtpHost = System.getenv("SMTP_HOST"); // e.g., "smtp.gmail.com"
    private final String smtpPort = System.getenv("SMTP_PORT"); // e.g., "587"

    public void sendAlert(String subject, String message) {
        Properties props = new Properties();
        props.put("mail.smtp.auth", "true");
        props.put("mail.smtp.starttls.enable", "true");
        props.put("mail.smtp.host", smtpHost);
        props.put("mail.smtp.port", smtpPort);

        Session session = Session.getInstance(props,
            new Authenticator() {
                protected PasswordAuthentication getPasswordAuthentication() {
                    return new PasswordAuthentication(username, password);
                }
            });

        try {
            Message msg = new MimeMessage(session);
            msg.setFrom(new InternetAddress(username));
            msg.setRecipients(Message.RecipientType.TO, InternetAddress.parse(adminEmail));
            msg.setSubject(subject);
            msg.setText(message);

            Transport.send(msg);
            System.out.println("Alert email sent.");
        } catch (MessagingException e) {
            System.err.println("Failed to send alert email: " + e.getMessage());
        }
    }
}

Note: By making the SMTP host and port configurable via environment variables, your application becomes more flexible and can easily work with different email providers (Gmail, SendGrid, AWS SES, etc.) across different deployment environments without code changes.

You can call sendAlert() from your SSRF detection filter or any other part of your application where you need to notify administrators.

Incident Response Plan

Having a solid incident response plan is essential for handling security breaches effectively. You can create a Java class to manage SSRF incidents, log them, alert the security team, and provide an interface for managing incidents.

Java

import java.util.*;
import java.util.logging.*;

public class SSRFIncidentHandler {
    private static final Logger logger = Logger.getLogger(SSRFIncidentHandler.class.getName());
    private final List<Incident> incidents = new ArrayList<>();
    private final AlertService alertService = new AlertService();

    public static class Incident {
        public final Date timestamp;
        public final String ip;
        public final String url;
        public boolean resolved;

        public Incident(String ip, String url) {
            this.timestamp = new Date();
            this.ip = ip;
            this.url = url;
            this.resolved = false;
        }
    }

    public Incident logIncident(String ip, String url) {
        Incident incident = new Incident(ip, url);
        incidents.add(incident);
        logger.warning(String.format("[%s] SSRF Attempt: %s -> %s", incident.timestamp, ip, url));
        alertTeam(incident);
        mitigate(ip);
        return incident;
    }

    private void alertTeam(Incident incident) {
        alertService.sendAlert(
            "SECURITY ALERT: SSRF attempt",
            "SSRF attempt from " + incident.ip + " targeting " + incident.url
        );
    }

    private void mitigate(String ip) {
        // In a real app, this might temporarily block the IP, adjust firewall rules, etc.
        logger.info("Mitigation: Temporarily blocking requests from " + ip);
    }

    public List<Incident> getIncidents(Boolean resolved) {
        if (resolved == null) {
            return new ArrayList<>(incidents);
        }
        List<Incident> filtered = new ArrayList<>();
        for (Incident incident : incidents) {
            if (incident.resolved == resolved) {
                filtered.add(incident);
            }
        }
        return filtered;
    }

    public boolean resolveIncident(int index) {
        if (index >= 0 && index < incidents.size()) {
            incidents.get(index).resolved = true;
            return true;
        }
        return false;
    }
}

You can integrate this handler into your servlet filters or controllers. For example, in a servlet:

Java

// Example usage in a servlet
SSRFIncidentHandler incidentHandler = new SSRFIncidentHandler();

protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
    String url = request.getParameter("url");
    if (url != null && isSuspiciousUrl(url)) {
        incidentHandler.logIncident(request.getRemoteAddr(), url);
        response.setStatus(HttpServletResponse.SC_FORBIDDEN);
        response.getWriter().write("{\"error\": \"Access denied\"}");
        return;
    }
    // Continue with normal processing
}

You can also create an admin endpoint (servlet or controller) to view and manage incidents.

Monitoring and Responding to SSRF Incidents

Introduction

The Importance of Monitoring

Setting Up Request Logging

Join the 1M+ learners on CodeSignal

Advanced SSRF Detection

Setting Up Alerts

Incident Response Plan

Conclusion