Thread by @abhaybhargav

#SSRF is a super popular vulnerability that is leveraged extensively, by bad actors. Let's look at SSRF defense in this 🧵 1/

Let's start with the basics. SSRF happens because your app makes requests to other URLs based on user-generated data. If your app doesnt need to redirect/request random URLs (functionality), ensure that you have a tight allowlist. Only redirect to URLs in the allowlist 2/

But if your app needs to redirect to a larger (purely user-defined) set of URLs, then things may get a little more complex. Now you need to validate inputs like a mf'er. Parse and Break down URLs by scheme, domain, etc. Validate each one as required 3/

Lets start with Defense-in-depth. Remember that cloud metadata access is a big part of using SSRF. If feasible, consider applying network security policies to prevent access to these metadata endpoints. These may be difficult though, especially if you need it 4/

In that case, especially for @awscloud using IMDSv2 will go a long way. For @kubernetesio consider not injection serviceAccountTokens in the pod unless you need it. 5/

@awscloud @kubernetesio Let's look at additional defense-in-depth. Test your libs for SSRF (among other things) a major source of SSRF vulnerabilities is third party libs and using patched/securely configured ones go a long way in preventing this 6/

@awscloud @kubernetesio A very simple http client config that you should enable is to turn off "following redirects". Malicious apps might force redirect to a local resource. This is a huge class of attacks that can entirely be prevented with this simple config 7/

@awscloud @kubernetesio DNS rebinding is an issue with SSRF flaws where a so called public domain resolves to an internal/localhost address. This is a little complex, because you need to be able to detect this malice when DNS resolves. You either need to use a DNS server that has these secure configs 8/

@awscloud @kubernetesio OR look at a DNS proxy on the server that is running the app. Either way, this is a little involved.
As you can see, SSRF is not "straightforward" a'la SQL injection. It has several dimensions, especially based on the type of app and the risk. It needs nuance in defense.

@awscloud @kubernetesio That's a wrap!

If you enjoyed this thread:

1. Follow me @abhaybhargav for more of these
2. RT the tweet below to share this thread with your audience

https://twitter.com/24335220/status/1506676453001334785