Server Side Request Forgery

[l0s]

I think it would be a good idea to add some slides in the "for engineers" deck that talk about Server Side Request Forgery (SSRF). As more applications are built (or migrated) using public cloud providers like AWS, SSRF attacks on metadata APIs will become more prevalent.

These are some resources on SSRF:

• https://application.security/
• https://www.blackhat.com/docs/us-17/thursday/us-17-Tsai-A-New-Era-Of-SSRF-Exploiting-URL-Parser-In-Trending-Programming-Languages.pdf
• https://blog.appsecco.com/an-ssrf-privileged-aws-keys-and-the-capital-one-breach-4c3c2cded3af

Takeaways for engineers:

• Follow the principle of least privilege to contain the blast radius.
• Don't blindly trust URLs from the client. Exercise caution when implementing URL unfurling logic or the like.
• Ensure any data retrieved from an API has the expected format before sending it to the client or clients. e.g. If an image is expected, ensure that an image was retrieved.
• For code that is meant to access public URLs, ensure it cannot access internal endpoints.
  ** Don't rely on regular expressions alone to filter out "bad IP addresses".