# SSRF: 通过 DNS 重新绑定绕过基于 IP 的黑名单访问 AWS 元数据端点

- **ID:** `security/ssrf-aws-metadata-timing`
- **领域:** security
- **类别:** network_error
- **错误码:** `SSRF-004`
- **验证级别:** ai_generated
- **修复率:** 78%

## 根因

SSRF 过滤器通过 IP 阻止对 169.254.169.254 的请求，但攻击者使用一个最初解析为良性 IP 的域名，在请求过程中重新绑定到元数据端点。

## 版本兼容性

| 版本 | 状态 | 引入 | 弃用 |
|------|------|------|------|
| AWS EC2 | active | — | — |
| Kubernetes 1.28 | active | — | — |
| Python requests 2.31.0 | active | — | — |

## 解决方案

1. ```
   Implement a DNS pinning mechanism: resolve the domain once and reject if the IP is in the blocklist, then use the resolved IP for the connection. Example in Python: `socket.getaddrinfo(url)` then check IP before making request.
   ```
2. ```
   Use a proxy that enforces DNS resolution and IP validation before forwarding requests, such as Squid with strict ACLs.
   ```
3. ```
   Disable HTTP redirects and follow redirects manually with IP validation at each step
   ```

## 无效尝试

- **** — DNS rebinding bypasses IP blocklists because the IP changes after the initial DNS resolution (85% 失败率)
- **** — The IP can change mid-request; a single check is insufficient (90% 失败率)
- **** — This breaks legitimate functionality and is not a practical fix (75% 失败率)