SSRF
CriticalServer-Side Request Forgery
Definition
Server-Side Request Forgery (SSRF) is a vulnerability that lets an attacker make the server send HTTP requests to arbitrary destinations. This can expose internal services, cloud metadata (such as AWS/GCP credentials) and allow scanning the organization's internal network.
Impact
Access to internal services not exposed to the internetTheft of cloud metadata credentials (AWS IMDSv1, GCP, Azure)Port scanning and internal network discoveryReading local files via file:// schemesRemote code execution by chaining with other internal services
Examples
Basic SSRF to AWS metadata
A URL preview feature lets the attacker point to the AWS metadata service (169.254.169.254), obtaining the server's temporary IAM credentials.
# Legitimate request
POST /api/preview
{"url": "https://example.com/image.png"}
# Malicious request to obtain AWS credentials
POST /api/preview
{"url": "http://169.254.169.254/latest/meta-data/iam/security-credentials/"}Filter bypass with a redirect
When the server validates the URL but does not follow redirects safely, the attacker can use their own domain that redirects to an internal IP.
# The server blocks internal IPs directly
# But the attacker uses a redirect from their own server
POST /api/fetch
{"url": "https://attacker.com/redirect"}
# At attacker.com/redirect:
HTTP/1.1 302 Found
Location: http://127.0.0.1:6379/