Web Security & OWASP (50 Qs)•Part 2: OWASP Top 10 & Critical Vulnerability Deep-Dives (11 - 25)
Server-Side Request Forgery (SSRF): AWS IMDSv2 protection, DNS rebinding, and egress proxies.
What is SSRF?
SSRF occurs when an attacker tricks a backend server into making HTTP requests to unexpected internal resources, cloud metadata services, or loopback interfaces that are not publicly exposed.
ini
[ Attacker ] ---> POST /api/generate-pdf?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/role
|
v
[ Vulnerable Backend Server ]
|
v (Internal AWS VPC Network)
[ AWS Instance Metadata Service (IMDS) ]
|
v (Leaks AWS IAM Temporary Secret Keys!)
1. AWS IMDSv2 (Session-Oriented Mitigation)
AWS IMDSv1 was vulnerable because any simple GET request returned IAM credentials. IMDSv2 requires a session token acquired via a PUT request with a custom header, which standard SSRF payloads cannot forge:
bash
# IMDSv2 Step 1: Request 6-hour session token (PUT required)
TOKEN=$(curl -s -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
# Step 2: Use token to query metadata
curl -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/
2. Network & DNS Rebinding Defenses
- Egress Proxy Allowlist: Route all outbound HTTP requests through a forward proxy (e.g. Squid) that explicitly blocks private IP ranges (
10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,127.0.0.0/8,169.254.169.254). - Resolve DNS First: Resolve the target domain to an IP before connecting; verify the resolved IP is not loopback or private (prevents DNS rebinding).