OWASP TOP 10: Server-Side Request Forgery (SSRF)

Often underestimated, SSRF is a dangerous vulnerability that can turn your trusted internal services into attack surfaces.

🔍 What is SSRF?

SSRF occurs when an attacker can make a server-side application send HTTP requests to an unintended location — often to internal-only services that should never be exposed to users.

🧪 Example

A web app allows users to fetch data from a URL: /fetch?url=https://example.com/data.json If the app doesn’t validate the input properly, an attacker could request: /fetch?url=http://localhost:8080/admin

✅ Best Practices to Prevent SSRF

1. Disable Unneeded Protocols: Avoid supporting non-HTTP protocols like file://, ftp://, or gopher://. Limit outbound requests to only necessary destinations.
2. Validate & Sanitize URLs: Implement strict allowlists for URLs or domains that can be accessed. Avoid user-controlled input being passed directly to fetch logic.
3. Restrict Network Access: Use firewall rules or VPC configurations to prevent the application from accessing internal-only services or metadata endpoints (like AWS’ 169.254.169.254).
4. Monitor Outbound Traffic: Keep an eye on unusual or unauthorized outbound connections. SSRF often involves requests to odd ports or internal addresses.
5. Proxy All External Requests: Use a proxy with strict rules for outgoing requests. This adds a control point and makes it easier to enforce allowlists.

🔐 SSRF isn’t just a security bug — it’s a gateway to your internal infrastructure.

Let’s stay a step ahead by validating input, isolating services, and restricting what servers can access.