URL Scanner

Server-Side Request Forgery (SSRF) is a web security vulnerability that allows attackers to make the server perform HTTP requests to arbitrary destinations, including internal network resources that are normally inaccessible from the outside. SSRF has consistently ranked among the OWASP Top 10 critical vulnerabilities and has been responsible for some of the most significant cloud security breaches in recent years, particularly in AWS environments where it can expose IAM credentials and metadata.

How SSRF Attacks Work

SSRF vulnerabilities arise when web applications fetch resources from URLs provided by users without adequate validation. Common features that introduce SSRF risk include URL preview generators, webhook processors, file importers, PDF generators, and - as in this case - URL scanning services. When an attacker submits a URL pointing to http://127.0.0.1, http://169.254.169.254 (the AWS metadata endpoint), or internal network addresses, the server dutifully makes the request and may return the response to the attacker.

In cloud environments, SSRF is especially dangerous. AWS EC2 instances expose an Instance Metadata Service (IMDS) at 169.254.169.254 that provides temporary IAM credentials, instance configuration, user data scripts, and other sensitive information. An SSRF vulnerability on an EC2 instance can allow attackers to steal IAM credentials and use them to access S3 buckets, databases, and other AWS services - potentially compromising an entire cloud infrastructure.

SSRF Bypass Techniques

Even when applications implement URL validation, attackers have numerous bypass techniques at their disposal. DNS rebinding can trick allowlist checks by resolving to an internal IP after validation. URL parsing inconsistencies between the validator and the HTTP client can be exploited using techniques like URL encoding, IPv6 addressing, decimal IP notation, and redirect chains. Alternative protocols like file://, gopher://, and dict:// may also be available depending on the HTTP library in use.

Defending Against SSRF

Effective SSRF prevention requires a defense-in-depth approach. Applications should validate and sanitize URLs on the server side, use allowlists of permitted domains and IP ranges, and block requests to private IP ranges and cloud metadata endpoints. AWS offers IMDSv2, which requires a session token obtained through a PUT request, making SSRF exploitation significantly harder. Network-level controls like VPC security groups and firewall rules provide additional protection by limiting what internal resources the web server can reach.