What Is SSRF (Server-Side Request Forgery)?

What SSRF Is

Server-Side Request Forgery (SSRF) is a vulnerability where an attacker can cause the server to make HTTP requests to destinations of the attacker's choosing — including internal network addresses that the attacker cannot reach directly.

A Typical Attack Scenario

A web application has a feature: "Fetch a URL and display its content" (URL previews, image downloaders, webhooks, PDF generators). The developer accepts user-supplied URLs without validation. The attacker supplies:

https://target-app.com/fetch?url=http://169.254.169.254/latest/meta-data/

On AWS EC2, this returns instance metadata including IAM role credentials:

{
  "AccessKeyId": "ASIA...",
  "SecretAccessKey": "...",
  "Token": "..."
}

The attacker now has temporary AWS credentials and can access S3 buckets, databases, or other AWS services.

What Attackers Can Reach via SSRF

• Cloud metadata: 169.254.169.254 (AWS/Azure/GCP/DO)
• Internal services: databases, admin panels, Kubernetes API servers
• Other servers on the VPC: internal APIs not exposed to the internet
• Localhost services: Redis, Memcached, Elasticsearch running on 127.0.0.1

Prevention Checklist

1. Never use user-supplied URLs directly in server-side requests
2. Validate the URL scheme: only allow http/https, block file://, gopher://, dict://
3. Resolve and validate the IP before fetching: reject private, loopback and link-local ranges
4. Block 169.254.169.254 explicitly: this metadata IP is critical
5. Follow redirects carefully: re-validate after each redirect
6. Use an allowlist: if possible, only allow fetching from known domains
7. Set request timeouts: prevent hanging on internal services
8. Limit response size: prevent data exfiltration via large responses

The Capital One Breach (2019)

A real-world example: a misconfigured WAF combined with an SSRF vulnerability allowed an attacker to query the AWS metadata endpoint and retrieve IAM credentials, ultimately exposing 100 million customer records.

ProfitTool's server-side tools use a hardened fetch utility that blocks all private IP ranges, validates DNS resolution, and enforces rate limiting.