SSRF-004 security network_error ai_generated true

SSRF: 通过 DNS 重新绑定绕过基于 IP 的黑名单访问 AWS 元数据端点

SSRF: AWS metadata endpoint accessed via DNS rebinding bypassing IP-based blocklists

ID: security/ssrf-aws-metadata-timing

其他格式: JSON · Markdown 中文 · English
78%修复率
82%置信度
1证据数
2023-11-20首次发现

版本兼容性

版本状态引入弃用备注
AWS EC2 active — — —
Kubernetes 1.28 active — — —
Python requests 2.31.0 active — — —

根因分析

SSRF 过滤器通过 IP 阻止对 169.254.169.254 的请求，但攻击者使用一个最初解析为良性 IP 的域名，在请求过程中重新绑定到元数据端点。

English

An SSRF filter blocks requests to 169.254.169.254 by IP, but an attacker uses a domain that initially resolves to a benign IP and later rebinds to the metadata endpoint during the request.

generic

官方文档

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html

解决方案

  1. Implement a DNS pinning mechanism: resolve the domain once and reject if the IP is in the blocklist, then use the resolved IP for the connection. Example in Python: `socket.getaddrinfo(url)` then check IP before making request.
  2. Use a proxy that enforces DNS resolution and IP validation before forwarding requests, such as Squid with strict ACLs.
  3. Disable HTTP redirects and follow redirects manually with IP validation at each step

无效尝试

常见但无效的做法:

  1. 85% 失败

    DNS rebinding bypasses IP blocklists because the IP changes after the initial DNS resolution

  2. 90% 失败

    The IP can change mid-request; a single check is insufficient

  3. 75% 失败

    This breaks legitimate functionality and is not a practical fix