SSRF-004 security network_error ai_generated true

SSRF: AWS metadata endpoint accessed via DNS rebinding bypassing IP-based blocklists

ID: security/ssrf-aws-metadata-timing

Also available as: JSON · Markdown · 中文
78%Fix Rate
82%Confidence
1Evidence
2023-11-20First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
AWS EC2 active — — —
Kubernetes 1.28 active — — —
Python requests 2.31.0 active — — —

Root Cause

An SSRF filter blocks requests to 169.254.169.254 by IP, but an attacker uses a domain that initially resolves to a benign IP and later rebinds to the metadata endpoint during the request.

generic

中文

SSRF 过滤器通过 IP 阻止对 169.254.169.254 的请求，但攻击者使用一个最初解析为良性 IP 的域名，在请求过程中重新绑定到元数据端点。

Official Documentation

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html

Workarounds

  1. 78% success Implement a DNS pinning mechanism: resolve the domain once and reject if the IP is in the blocklist, then use the resolved IP for the connection. Example in Python: `socket.getaddrinfo(url)` then check IP before making request. 
    Implement a DNS pinning mechanism: resolve the domain once and reject if the IP is in the blocklist, then use the resolved IP for the connection. Example in Python: `socket.getaddrinfo(url)` then check IP before making request.
  2. 82% success Use a proxy that enforces DNS resolution and IP validation before forwarding requests, such as Squid with strict ACLs. 
    Use a proxy that enforces DNS resolution and IP validation before forwarding requests, such as Squid with strict ACLs.
  3. 75% success Disable HTTP redirects and follow redirects manually with IP validation at each step 
    Disable HTTP redirects and follow redirects manually with IP validation at each step

中文步骤

  1. Implement a DNS pinning mechanism: resolve the domain once and reject if the IP is in the blocklist, then use the resolved IP for the connection. Example in Python: `socket.getaddrinfo(url)` then check IP before making request.
  2. Use a proxy that enforces DNS resolution and IP validation before forwarding requests, such as Squid with strict ACLs.
  3. Disable HTTP redirects and follow redirects manually with IP validation at each step

Dead Ends

Common approaches that don't work:

  1. 85% fail

    DNS rebinding bypasses IP blocklists because the IP changes after the initial DNS resolution

  2. 90% fail

    The IP can change mid-request; a single check is insufficient

  3. 75% fail

    This breaks legitimate functionality and is not a practical fix