SSRF Prevention リファレンス
リファレンス 用 サーバー-Side リクエスト Forgery: causes, impact, および prevention techniques.
SSRF Attack Patterns
SSRF tricks a server into making requests to attacker-controlled or internal URLs. Basic SSRF fetches internal services (metadata endpoints, admin panels). Blind SSRF confirms requests without seeing responses. Semi-blind SSRF infers responses via timing or error differences. DNS rebinding bypasses URL allowlists by changing DNS resolution between validation and fetch. Cloud metadata endpoints (169.254.169.254) are high-value SSRF targets, leaking credentials.
- internal
- Fetch internal services
- blind
- No response visible
- rebinding
- Bypass allowlist
metadata, adminconfirm via timingDNS changePrevention Measures
Validate and allowlist destination hosts and IP ranges; reject private/loopback/link-local addresses. Resolve DNS once and use the IP for the actual request (prevent rebinding). Disable HTTP redirects or re-validate after redirect. Use a separate egress proxy with strict network policies. Do not send raw server responses to clients. Cloud platforms offer IMDSv2 requiring a token, mitigating metadata SSRF. Segment networks so application servers cannot reach internal services directly.
- allowlist
- Hosts and IPs
- no redirect
- Or re-validate
- IMDSv2
- Token required
reject private rangesprevent bypasscloud metadata