Server-Side Request Forgery (SSRF) Detection — ShipSafe

What is SSRF?

Server-Side Request Forgery (SSRF) occurs when an attacker can make the server send HTTP requests to arbitrary destinations. This can expose internal services, cloud metadata endpoints (like AWS IMDSv1 at 169.254.169.254), and private network resources that should not be accessible from the internet.

Why It Matters

SSRF is the number one way attackers escalate from a web vulnerability to full cloud account compromise. On AWS, a successful SSRF against the IMDSv1 metadata endpoint returns temporary IAM credentials — giving the attacker the same permissions as the EC2 instance role. The 2019 Capital One breach (100 million customer records) was caused by SSRF to the metadata endpoint. Even without cloud metadata, SSRF lets attackers scan internal networks, access administrative interfaces (Redis, Elasticsearch, Kubernetes API), and reach services that are only supposed to be accessible from within the VPC.

What ShipSafe Detects

• ✓User-controlled URLs in fetch(), axios, http.get(), got(), needle(), and request libraries
• ✓Missing URL validation and domain allowlist enforcement before HTTP requests
• ✓DNS rebinding attacks through TOCTOU (time-of-check-time-of-use) vulnerabilities where a domain resolves differently between validation and request
• ✓IP allowlist bypass using decimal (2130706433), octal (0177.0.0.1), hex (0x7f.0.0.1), and IPv6 (::1, ::ffff:127.0.0.1) representations of private addresses
• ✓Redirect-based SSRF where an external URL responds with a 3xx redirect to an internal address
• ✓Cloud metadata endpoint access patterns for AWS, GCP, and Azure IMDS
• ✓Internal network scanning via user-controlled host, port, or path parameters

Example: Vulnerable Code

Vulnerable URL preview endpoint with SSRF

// Vulnerable: user-controlled URL in server-side fetch
app.post("/preview", async (req, res) => {
  const { url } = req.body;
  const response = await fetch(url);
  const html = await response.text();
  res.json({ preview: html.slice(0, 500) });
});

// An attacker sends url: "http://169.254.169.254/latest/meta-data/iam/security-credentials/"
// The server fetches its own AWS IAM credentials and returns them to the attacker.

ShipSafe Catches It

$ shipsafe scan

  CRITICAL  ssrf/user-controlled-url
  src/routes/preview.ts:3
  User input from req.body controls the URL in a server-side HTTP request.
  Fix: Validate URL against an allowlist of permitted domains. Block private IPs and cloud metadata endpoints.

What to Do Instead

Safe alternative: domain allowlist, private IP blocking, and redirect prevention

// SAFE: URL validation with domain allowlist and private IP blocking
import { URL } from "url";
import dns from "dns/promises";

const ALLOWED_PROTOCOLS = ["http:", "https:"];
const BLOCKED_HOSTS = ["169.254.169.254", "metadata.google.internal"];

async function isPrivateIP(hostname: string): Promise<boolean> {
  const { address } = await dns.lookup(hostname);
  return /^(127\.|10\.|172\.(1[6-9]|2\d|3[01])\.|192\.168\.|169\.254\.)/.test(address)
    || address === "::1" || address === "0.0.0.0";
}

app.post("/preview", async (req, res) => {
  const { url: rawUrl } = req.body;

  // Parse and validate the URL structure
  let parsed: URL;
  try { parsed = new URL(rawUrl); }
  catch { return res.status(400).json({ error: "Invalid URL" }); }

  // Enforce protocol allowlist
  if (!ALLOWED_PROTOCOLS.includes(parsed.protocol)) {
    return res.status(400).json({ error: "Only HTTP(S) allowed" });
  }

  // Block known metadata endpoints and private IPs
  if (BLOCKED_HOSTS.includes(parsed.hostname) || await isPrivateIP(parsed.hostname)) {
    return res.status(403).json({ error: "Blocked destination" });
  }

  // Fetch with redirect disabled to prevent redirect-based SSRF
  const response = await fetch(rawUrl, { redirect: "error" });
  const html = await response.text();
  res.json({ preview: html.slice(0, 500) });
});

Frequently Asked Questions

Related Security Categories