Slide 28 of 28
CompleteSlide 28
Module Complete
You finished API7 — Server Side Request Forgery. Here’s what you now understand:
What SSRF is — an API that fetches user-supplied URLs server-side, letting the attacker make the server reach internal targets it can’t access directly
Why APIs are specifically exposed — webhooks, file import, link preview, and integration features are all legitimate URL-fetching patterns that become SSRF vectors
The cloud metadata jackpot — 169.254.169.254 returns IAM credentials; SSRF that reaches it yields cloud account access
Two attack patterns: cloud credential theft (SSRF → metadata → IAM keys → cloud data) and internal network pivot (SSRF → internal services that trust internal callers)
Real incidents — Capital One 2019 ($270M total cost, 100M records) and GitLab CVE-2021-22214 (unauthenticated SSRF via CI lint API)
Three bypass techniques — DNS rebinding, redirect chains, and alternative IP notations — and why allowlists + IP validation + redirect disabling are required together
Seven mitigations: URL allowlist, post-DNS IP validation, disable redirects, no raw response return, internal service auth, network isolation, and metadata endpoint monitoring
The one thing to carry forward

Your server is inside the network. Every URL it fetches is fetched from inside — with access to internal services, cloud credentials, and local files that the caller cannot reach directly. User-supplied URLs must be validated against what your server can reach, not just what a browser would reach. The default assumption must be: this URL could be the metadata endpoint.

← Back to Quiz Next: API8 — Security Misconfiguration →