security security_error ai_generated true

SSRF: Request to internal network address blocked

ID: security/ssrf-internal-network

Also available as: JSON · Markdown
85%Fix Rate
87%Confidence
3Evidence
2023-01-01First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
any active — — —

Root Cause

Server-Side Request Forgery allows attackers to access internal services via application.

generic

Workarounds

  1. 90% success Use allowlist of permitted external domains/IPs 
    Only allow requests to known-good external domains
  2. 85% success Resolve DNS and validate IP is not in private ranges before connecting 
    Check against 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16

Dead Ends

Common approaches that don't work:

  1. Block only localhost and 127.0.0.1 85% fail

    Misses 0.0.0.0, IPv6 ::1, 169.254.x.x metadata, DNS rebinding, and decimal IP notation.

  2. Validate URL scheme is HTTPS only 70% fail

    Does not prevent requests to internal HTTPS services.