API7:2023 — Server Side Request Forgery

Slide 12 · Pattern 2 Mechanics

SSRF → Internal IP → Unauthenticated Service → Lateral Movement

Inside the network, services trust each other. SSRF puts the attacker inside.

THE SETUP

A microservices environment where internal services skip auth

The API has a webhook feature: POST /api/webhooks { "url": "https://your-server.com/callback" }

When a payment event occurs, the API POSTs to that URL. The URL is user-configurable.

Internal services on the same network: http://10.0.1.5:8080/admin (internal admin panel, no auth because “only internal traffic reaches it”), http://10.0.1.10:6379 (Redis, no auth), http://10.0.1.20:9200/_cat/indices (Elasticsearch cluster).

1️⃣

Port scanning via SSRF

Attacker registers webhooks with URLs like http://10.0.1.1:22/, http://10.0.1.1:80/, etc. and infers from response times and error codes which ports are open. Builds a map of the internal network.

2️⃣

Unauthenticated admin panel access

Webhook to http://10.0.1.5:8080/admin/users returns all user records. Admin panel trusts the request because it came from an internal IP. The attacker reads responses via the API.

3️⃣

Redis / Elasticsearch data access

Webhook to http://10.0.1.20:9200/customers/_search returns Elasticsearch data. If Redis accepts HTTP-like commands via SSRF (RESP protocol), an attacker can read cached session tokens or queue data.

← Back Real incident: GitLab →