# SSRF: AWS metadata endpoint accessed via DNS rebinding bypassing IP-based blocklists

- **ID:** `security/ssrf-aws-metadata-timing`
- **Domain:** security
- **Category:** network_error
- **Error Code:** `SSRF-004`
- **Verification:** ai_generated
- **Fix Rate:** 78%

## Root Cause

An SSRF filter blocks requests to 169.254.169.254 by IP, but an attacker uses a domain that initially resolves to a benign IP and later rebinds to the metadata endpoint during the request.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| AWS EC2 | active | — | — |
| Kubernetes 1.28 | active | — | — |
| Python requests 2.31.0 | active | — | — |

## Workarounds

1. **Implement a DNS pinning mechanism: resolve the domain once and reject if the IP is in the blocklist, then use the resolved IP for the connection. Example in Python: `socket.getaddrinfo(url)` then check IP before making request.** (78% success)
   ```
   Implement a DNS pinning mechanism: resolve the domain once and reject if the IP is in the blocklist, then use the resolved IP for the connection. Example in Python: `socket.getaddrinfo(url)` then check IP before making request.
   ```
2. **Use a proxy that enforces DNS resolution and IP validation before forwarding requests, such as Squid with strict ACLs.** (82% success)
   ```
   Use a proxy that enforces DNS resolution and IP validation before forwarding requests, such as Squid with strict ACLs.
   ```
3. **Disable HTTP redirects and follow redirects manually with IP validation at each step** (75% success)
   ```
   Disable HTTP redirects and follow redirects manually with IP validation at each step
   ```

## Dead Ends

- **** — DNS rebinding bypasses IP blocklists because the IP changes after the initial DNS resolution (85% fail)
- **** — The IP can change mid-request; a single check is insufficient (90% fail)
- **** — This breaks legitimate functionality and is not a practical fix (75% fail)