Please enable JavaScript.
Coggle requires JavaScript to display documents.
Server -side Request Forgery (port scanning (open (request hangs for a few…
Server -side Request Forgery
reporting dashboard
ability to poll a URL
pull in CSV data that it returns
Every n minutes
makes web request
updates dashboard
show fresh table
port scanning
internal network
open
request hangs for a few
seconds bef returning
port open but not handling HTTP requests
closed
request returns immediately
Difficulty
SSRF bugs
require transversing many levels of indirection
set up some feature
upload specific file
contains SSRF payload
trigger some processing
bugs evade discovery for many years
mitigation
limit connections to port 80 (HTTP) and 443(HTTPS)
prevent port scanning
resolve IP of target host
IP is for that
external host
disabie access to any protocol scheme not HTTP or HTTPS
attacker controls target of HTTP(s) requests coming from server