Understanding SSRF: Server-Side Request Forgery Explained

What Is SSRF?

Server-Side Request Forgery (SSRF) occurs when an attacker tricks a server into making HTTP requests to internal or restricted resources. It's particularly dangerous in cloud environments where metadata services (like AWS's 169.254.169.254) give access to instance credentials.

Why Is SSRF So Dangerous?

In the 2019 Capital One breach, an SSRF vulnerability led to the exposure of 100 million customer records. The attacker exploited a WAF misconfiguration to reach the AWS metadata service and steal IAM credentials.

Real-World SSRF Vectors

1. URL Fetching Features

Applications that fetch external URLs are prime targets:

- fetch(userProvidedUrl).then(res => res.json())
+ const allowedHosts = ["api.trusted.com", "cdn.example.com"];
+ const url = new URL(userProvidedUrl);
+ if (!allowedHosts.includes(url.hostname)) throw new Error("Blocked");
+ fetch(url).then(res => res.json())

2. File Imports

- <img src={userInput} />
+ const sanitized = sanitizeUrl(userInput);
+ if (!sanitized.startsWith("https://trusted-cdn.com/")) return;
+ <img src={sanitized} />

Sentinel's SSRF Protection

Sentinel's scan engine includes a built-in SSRF guard that:

Resolves all domain names to IP addresses before scanning
Checks each IP against a blocklist (RFC 1918 private ranges, link-local, loopback, metadata IPs)
Blocks the scan if any resolved address is internal

This guard is visible in our middleware and public API endpoints:

const blockedRanges = [
  "10.0.0.0/8",
  "172.16.0.0/12",
  "192.168.0.0/16",
  "127.0.0.0/8",
  "169.254.169.254/32", // AWS metadata
];

How to Test for SSRF

Use Sentinel's public scan to check your domain for:

Open redirect endpoints that could be chained with SSRF
API routes that accept arbitrary URLs
Missing URL validation patterns

Summary

SSRF is a "gift that keeps on giving" for attackers. It turns your cloud infrastructure against you. Validate all URLs, block private IP ranges, and never fetch user-supplied URLs without strict allowlisting.