Server-Side Request Forgery (SSRF) Vulnerability

How to Prevent SSRF Vulnerabilities

1. Input Validation

Implement thorough URL validation:

// Whitelist allowed schemes
$allowed_schemes = ['http', 'https'];
$parsed_url = parse_url($url);
if (!isset($parsed_url['scheme']) || !in_array($parsed_url['scheme'], $allowed_schemes)) {
    return 'Invalid URL scheme';
}

// Whitelist allowed domains
$allowed_domains = ['example.com', 'trusted-domain.com'];
$hostname = $parsed_url['host'];
$is_allowed = false;
foreach ($allowed_domains as $domain) {
    if (strcasecmp($hostname, $domain) === 0 || 
        preg_match('/\\.' . preg_quote($domain, '/') . '$/', $hostname)) {
        $is_allowed = true;
        break;
    }
}
if (!$is_allowed) {
    return 'Domain not in whitelist';
}
        

2. Block Private IP Ranges

Prevent requests to internal networks:

// Resolve hostname to IP
$ip = gethostbyname($hostname);

// Check against private IP ranges
$private_ranges = [
    '10.0.0.0/8',       // Private network
    '172.16.0.0/12',    // Private network
    '192.168.0.0/16',   // Private network
    '127.0.0.0/8',      // Localhost
    '169.254.0.0/16',   // Link-local
    // ... other restricted ranges
];

foreach ($private_ranges as $range) {
    if (ip_in_range($ip, $range)) {
        return 'IP address not allowed';
    }
}
        

3. Use Allow Lists Instead of Block Lists

Whitelist allowed resources rather than trying to block malicious ones:

// Instead of trying to block all internal IPs,
// only allow specific external domains or APIs

$allowed_endpoints = [
    'api.github.com',
    'api.stripe.com',
    'maps.googleapis.com'
];

if (!in_array($hostname, $allowed_endpoints)) {
    return 'Endpoint not allowed';
}
        

4. Disable Unused URL Schemas

Restrict the application to only use necessary protocols:

// In PHP with curl
curl_setopt($ch, CURLOPT_PROTOCOLS, CURLPROTO_HTTP | CURLPROTO_HTTPS);
curl_setopt($ch, CURLOPT_REDIR_PROTOCOLS, CURLPROTO_HTTP | CURLPROTO_HTTPS);

// In Java with URLConnection
if (!"http".equals(url.getProtocol()) && !"https".equals(url.getProtocol())) {
    throw new IllegalArgumentException("Only HTTP(S) is allowed");
}
        

5. Use a Separate Service

Isolate URL-fetching functionality in a separate service with limited privileges:

• Run the service in a container or VM with no access to internal networks
• Implement rate limiting and strict timeouts
• Return rendered content rather than raw responses

6. Implement DNS Rebinding Protection

Prevent DNS rebinding attacks by validating the IP both before and after the request:

// Resolve the hostname once and use that IP for the actual request
$hostname = parse_url($url, PHP_URL_HOST);
$ip = gethostbyname($hostname);

// In curl, use CURLOPT_RESOLVE to force the IP
curl_setopt($ch, CURLOPT_RESOLVE, ["$hostname:443:$ip"]);
        

7. Use Network-Level Protection

• Implement proper network segmentation
• Place metadata services on a separate network that's unreachable from application servers
• Use egress filtering to restrict outbound connections
• Require authentication for all internal services, even from internal networks