Server-Side Request Forgery (SSRF)

Also Known As

TL;DR

Explanation

SSRF allows attackers to make the server issue requests to arbitrary URLs — including internal services (cloud metadata endpoints, databases, admin interfaces) not exposed to the public internet. In cloud environments, SSRF against 169.254.169.254 can expose IAM credentials. Mitigation: validate and allowlist target URLs, block private IP ranges, reject non-http(s) schemes, and prefer dedicated HTTP client libraries with configurable restrictions.

How It's Exploited

Diagram

flowchart TD
    ATK[Attacker] -->|fetch http://internal-api/secret| APP[Vulnerable App<br/>fetch URL param]
    APP -->|request from server| INT[Internal API<br/>192.168.1.100]
    APP -->|request from server| META[AWS Metadata<br/>169.254.169.254]
    INT & META -->|sensitive data| APP --> ATK
    subgraph Fix
        ALLOW[Allowlist external URLs<br/>Block internal IP ranges<br/>169.254/10.x/172.16/192.168]
    end
style FIX fill:#238636,color:#fff
style INT fill:#f85149,color:#fff
style META fill:#f85149,color:#fff

Common Misconception

Why It Matters

Common Mistakes

• Fetching user-supplied URLs with curl_exec() or file_get_contents() without validating the resolved IP.
• DNS rebinding bypass: validating the hostname but not re-checking the IP at connection time.
• Not blocking private IP ranges (10.x, 172.16.x, 192.168.x, 127.x, 169.254.x) after DNS resolution.
• Allowing file://, gopher://, or dict:// URL schemes alongside http://

Code Examples

\$url  = \$_POST['webhook_url'];
\$resp = file_get_contents(\$url); // SSRF — attacker controls the URL

function safeRequest(string \$url): string {
    \$parsed = parse_url(\$url);

    // Only allow HTTPS to public internet
    if (\$parsed['scheme'] !== 'https') throw new \InvalidArgumentException('HTTPS required');

    // Block private/internal IP ranges
    \$ip = gethostbyname(\$parsed['host']);
    if (filter_var(\$ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) === false) {
        throw new \InvalidArgumentException('Private/reserved IP not allowed');
    }

    return (new GuzzleHttp\Client())->get(\$url)->getBody()->getContents();
}

References

• ↗ https://owasp.org/www-community/attacks/Server_Side_Request_Forgery
• ↗ https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html
• ↗ https://cwe.mitre.org/data/definitions/918.html

Tags

Related Terms