SSRF Server-Side Request Forgery#

The SSRF server-side request forgery vulnerability, also known as XSPA cross-site port attack, is a security vulnerability in which an attacker constructs exploitative code that causes the server to initiate exploit requests. In general, the applications targeted by SSRF attacks cannot be accessed from the external network, so attackers need to leverage the target server to initiate the attack. The target server may have access to both the internal and external networks, allowing attackers to exploit internal network applications through the target host.

Description#

SSRF involves forging server-side requests to bypass client data limitations. Typically, attackers interact with the internal network by forging server requests, thereby gaining access to and potentially attacking the internal network. SSRF is often combined with various attack methods. The SSRF attack uses insecure servers within a domain as proxies, which is similar to cross-site request forgery attacks using web clients. For example, browsers within a domain can act as proxies for attackers. In some cases, server-side programs need to retrieve data from other server applications, such as retrieving images and data. However, if the server does not filter or restrict the target addresses of its requests, hackers can exploit this loophole to request arbitrary server resources, including applications hidden within the internal network. Many believe that servers within the internal network are immune to hacker attacks and thus neglect to patch vulnerabilities or perform version upgrades. The prevalence of weak passwords within the internal network renders it vulnerable to exploitation through SSRF. While SSRF vulnerabilities typically appear in the context of HTTP/HTTPS, similar vulnerabilities can also be found in TCP Connect, which can be used to detect the activity status of internal network IPs and the availability of open ports, although the impact of such vulnerability is relatively small.

Common Scenarios for SSRF Vulnerabilities#

Any place that can initiate network requests to the external network may potentially contain an SSRF vulnerability.

• Remote server resource requests such as Upload from URL, Import & Export RSS Feed.
• Built-in database features in Oracle, MongoDB, MSSQL, Postgres, CouchDB.
• Receiving emails from other mail servers in Webmail such as POP3, IMAP, SMTP.
• File processing, encoding, and metadata handling in applications like ffmpeg, ImageMagic, DOCX, PDF, XML.
• Sharing web pages via URL addresses.
• Unpublished API implementations and other functionalities that use URL calls.

Exploitation of SSRF Vulnerabilities#

• Scanning ports on the external network, server's internal network, and local system to retrieve service banner information.
• Attacking applications running on the internal network or locally, such as overflow attacks.
• Fingerprinting internal web applications by accessing default files.
• Attacking web applications both internally and externally using GET parameters, such as Struts2 and sqli.
• Reading local files using the file protocol, and other such exploits.

Bypass Techniques#

Localhost Attack#

Utilizing @ Symbol to Bypass#

Shortened URL to Bypass#

Special Domain Name Bypass#

Utilizing Enclosed Alphanumerics#

Use period replace dot to bypass#

Bypass using other bases#

Special domain name bypass#

Experimental target machine example#

Using PHP to build a target machine as an example, write the following code in test.php, in fact, an important principle to avoid this type of attack is to filter user input and never trust user input.

<?php
// Create a new cURL resource
$ch = curl_init();
// Set the URL and related options
curl_setopt($ch, CURLOPT_URL, $_GET['url']);
curl_setopt($ch, CURLOPT_HEADER, false);
// Fetch the URL and pass it to the browser
curl_exec($ch);
// Close cURL resources and release system resources
curl_close($ch);

Use of file protocol#

In the above example, sending a GET request can obtain sensitive file information.

Use of gopher protocol#

The gopher protocol was introduced earlier than the http protocol and is now not commonly used, but in the exploitation of SSRF vulnerabilities, gopher can be considered versatile because it can use gopher to send requests in various formats, solving the problem of the vulnerability not being in the GET parameter.
Basic protocol format: URL:gopher://<host>:<port>/<gopher-path>.
The following request can send a POST request, with the value of the parameter cmd being balabal. When constructing the gopher request, you need to double URL encode the line feed and carriage return %250d%250a.

Application of dict protocol#

The dict protocol is a dictionary server protocol, usually used to allow clients to access more dictionary sources during use. However, in SSRF, if you can use the dict protocol, you can easily obtain information about the services running on the target server port, such as service versions.

Daily Question#

References#