You should know about Server-Side Request Forgery

Summary

Server-side request forgery (SSRF) lets attackers make an application server issue HTTP requests, potentially reaching internal resources behind its security perimeter and taking over the hosting environment. The post describes two common patterns—user-supplied URLs and user data incorporated into URLs—and presents Smokescreen, an egress proxy, as a mitigation. Smokescreen checks that requested IP addresses are publicly routed, blocking private IPv4 ranges and IPv6 ULA space, while ACL actions can open, report, or enforce traffic rules. The Fly modification authenticates clients with a shared PROXY_PASSWORD, maps authenticated requests to an authed role, and includes deployment instructions for Fly and Docker plus Go and Node.js examples that send authenticated HTTPS requests through the proxy.

Takeaways

1. 1

   SSRF commonly appears in webhook-style features that accept destination URLs or in features that insert user data into request URLs.

2. 2

   Smokescreen checks destinations against private IPv4 ranges 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16, along with IPv6 ULA space fc00::/7.

3. 3

   Its ACL actions distinguish open traffic, report-only logging for out-of-list requests, and enforce mode, which blocks requests not on the allowed list.