SERVER-SIDE REQUEST FORGERY

A security flaw known as server-side request forgery (SSRF) allows an attacker

to send specially constructed requests to internal or external resources from a
compromised server. These requests are made by the server on the attacker's
behalf, frequently getting beyond firewalls and network access constraints.
Applications that let users enter URLs or other information that the server then
retrieves or uses are usually vulnerable to SSRF attacks.

Key Points of SSRF:

1. Exploiting the Server: In SSRF, the attacker targets the server-side
application, which may make requests to other services or resources. The
attacker manipulates the request parameters to make the server contact
unauthorized or internal resources.
2. Internal Network Access: Attackers can use SSRF to access internal
services that are typically protected by firewalls or other network security
measures. This can expose sensitive information, such as metadata
services or private APIs.
3. Potential Impacts:

Report by Komalseerut Kaur

 o Access to Internal Resources: Attackers can access internal
databases, services, or APIs not intended to be exposed to the
outside world.
o Exploitation of Cloud Metadata: In cloud environments like
AWS or Google Cloud, SSRF can be used to access instance
metadata (e.g., credentials, secrets), leading to further exploitation.
o Denial of Service (DoS): An attacker can also use SSRF to
overload internal services by sending excessive requests.

Example:
If a web application accepts a URL to fetch some content and doesn't validate
the URL properly, an attacker could provide a URL like:
[Link]
This could force the server to attempt to fetch content from an internal admin
page that should not be publicly accessible.

Types of SSRF:
Server-Side Request Forgery (SSRF) vulnerabilities can manifest in various
forms depending on the type of requests that are exploited, how the requests are
constructed, and the intended targets. Here are the main types of SSRF:
1. Basic SSRF
In basic SSRF, an attacker manipulates user input to send requests to arbitrary
URLs or internal services. The attacker controls the input that the server uses to
fetch external resources, but the exploitation is generally limited to making
requests to services that the server has direct access to (internal or external).
 Example: A web application that fetches an image from a URL provided
by the user. An attacker could provide a URL like [Link]
causing the server to make a request to a local administrative interface.
2. Blind SSRF

Report by Komalseerut Kaur

Blind SSRF occurs when the server does not provide any immediate feedback to
the attacker after making a request. However, the attacker can still exploit the
SSRF vulnerability to make requests to internal services or metadata endpoints.
In a blind SSRF, the attacker must rely on out-of-band or indirect methods to
detect if the attack has succeeded, such as by observing server behavior or
making repeated requests.
 Example: An attacker might try to send requests to internal IP addresses
or cloud metadata services. Since no direct feedback is provided (i.e., the
server doesn’t return the content of the request), the attacker uses
techniques like timing or error responses to infer success.
3. DOM-Based SSRF
DOM-based SSRF involves client-side manipulation of the Document Object
Model (DOM) in the browser. In this case, the attacker does not directly control
server-side requests but manipulates how the server constructs the URL or
request based on user inputs.
 Example: A vulnerable JavaScript component on the frontend allows a
user to provide a URL that will be passed back to the server. By
modifying the DOM, the attacker may cause the server to make
unintended internal requests.
4. HTTP/HTTPS SSRF
This is the most common form of SSRF, where the attacker forces the server to
make an HTTP or HTTPS request to an arbitrary server. Since the server often
runs within a trusted network, the attacker can use this to bypass external
firewalls or restrictions and access internal services.
 Example: The attacker provides a URL like [Link]
forcing the server to fetch a resource from an internal service that should
not be exposed to the outside world.
5. FTP/SMTP/Other Protocol SSRF
SSRF can also target other protocols besides HTTP or HTTPS, such as FTP,
SMTP, or DNS. These vulnerabilities can allow attackers to interact with a
variety of network protocols, making SSRF more versatile.
 Example: An attacker might manipulate an application that interacts with
FTP servers, causing it to connect to a private internal FTP service
([Link] or send emails via SMTP to an unauthorized recipient.
6. Local File Inclusion (LFI) / Remote File Inclusion (RFI) with SSRF

Report by Komalseerut Kaur

In some cases, SSRF can be combined with other vulnerabilities, such as Local
File Inclusion (LFI) or Remote File Inclusion (RFI), to escalate the attack. Here,
the attacker uses SSRF to interact with a file system or web server and includes
or accesses sensitive files (e.g., /etc/passwd or /var/log/[Link]).
 Example: The attacker may craft a request that allows the server to fetch
a file from the local file system and use SSRF to access resources from
internal systems that shouldn't be exposed.
7. Exploiting Cloud Metadata Services (Cloud SSRF)
In cloud environments like AWS, Google Cloud, or Azure, SSRF can be used to
interact with cloud metadata services. These metadata services often contain
sensitive information like instance metadata, security credentials, and
environment data. Exploiting SSRF to query these services can expose access
tokens, credentials, and other secrets.
 Example: In AWS, SSRF can be exploited to access the instance
metadata API (e.g., [Link] to obtain
sensitive credentials like AWS API keys.
8. Recursive SSRF
Recursive SSRF occurs when the attacker repeatedly causes the server to make
multiple requests in a chain or loop. The server might fetch resources from
external URLs, but each external resource could further trigger requests to
internal systems. This makes it harder to control and detect.
 Example: An attacker causes the server to repeatedly fetch internal URLs
in a loop, using recursion to move deeper into the system and gather
information about internal services.
9. Out-of-Band (OOB) SSRF
Out-of-band SSRF involves exploiting the vulnerability to send requests to
external services or systems where the results of the request are not returned
directly to the attacker. Instead, the attacker may use methods like DNS
resolution, HTTP status codes, or other out-of-band channels to receive
feedback on the request.
 Example: The attacker crafts an SSRF payload that triggers an internal
request to a DNS server, and the server responds to the attacker with
information about internal services by querying the external DNS server.

Report by Komalseerut Kaur

 CASE STUDIES

1. Amazon Web Services (AWS) – EC2 Metadata Access

Year: 2017
Company: Amazon Web Services (AWS)
Vulnerability: SSRF to access EC2 metadata
Impact: Exposure of sensitive credentials and access tokens
Scenario:
An attacker exploited an SSRF vulnerability in a service that allowed users to
submit URLs for fetching remote content. The attacker crafted a URL pointing
to the internal EC2 metadata service (e.g., [Link]
data/), which is typically accessible only from within the AWS instance. By
manipulating the server to make the request on behalf of the attacker, the
attacker was able to retrieve instance metadata containing sensitive data like
access keys, IAM roles, and secret credentials.
Mitigation:
 Amazon took steps to restrict metadata access by introducing a Metadata
Service Hop Limit and also enforcing role-based access controls on the
metadata service.
 Additionally, users were advised to disable the EC2 metadata service
when it was not required or when running in a cloud-native environment.

2. GitHub – Internal Port Scanning via SSRF

Year: 2014
Company: GitHub
Vulnerability: SSRF vulnerability leading to internal network scanning
Impact: Compromise of internal GitHub services
Scenario:
GitHub discovered an SSRF vulnerability in one of their web applications. The
issue allowed an attacker to send a request to an internal service by providing a
specially crafted URL. Through this SSRF vulnerability, the attacker was able to

Report by Komalseerut Kaur

scan GitHub's internal network, discovering services that were not publicly
exposed.
Impact:
While the attacker did not directly gain access to sensitive data, this SSRF
vulnerability could have been used to escalate the attack further, leading to data
exfiltration or potential remote code execution if combined with other
vulnerabilities.
Mitigation:
 GitHub introduced restrictions on URL parsing and strengthened input
validation.
 The server was also configured to deny requests to private IP addresses or
internal services.
 The SSRF vulnerability was fixed by limiting the ability to make requests
to non-whitelisted domains.

3. Uber – Cloud Metadata Service Exposure

Year: 2016
Company: Uber
Vulnerability: SSRF vulnerability targeting metadata service
Impact: Unauthorized access to credentials
Scenario:
In this case, an attacker exploited an SSRF vulnerability to access Uber's
internal services, particularly targeting a metadata service hosted within their
cloud infrastructure. By leveraging the SSRF vulnerability, the attacker was able
to send requests to the metadata service, which exposed API keys and other
sensitive data.
Impact:
The attacker was able to gain access to Uber's private internal metadata, which
led to unauthorized access to sensitive information stored in their internal
systems. This type of SSRF exploit is especially concerning because it grants
the attacker the ability to escalate their privileges and gain access to further
internal systems and cloud resources.

Report by Komalseerut Kaur

Mitigation:
 Uber restricted access to the metadata service and introduced additional
network segmentation to prevent such attacks from succeeding.
 Additional security layers were added, including better filtering of user-
controlled URLs and access controls to protect sensitive cloud metadata.

4. Twitter – SSRF Leading to Data Breach

Year: 2020
Company: Twitter
Vulnerability: SSRF vulnerability to access internal systems
Impact: Breach of internal data
Scenario:
Twitter discovered an SSRF vulnerability in one of their internal services that
processed URLs. By crafting a specific payload, an attacker could use SSRF to
make requests to internal services within Twitter's infrastructure, bypassing
firewalls that would otherwise prevent such access.
Impact:
An attacker could retrieve internal data such as configuration files or other
sensitive information, potentially leading to the exfiltration of sensitive data and
compromise of internal systems. This exploit could be used as a stepping stone
to further compromise the system.
Mitigation:
 Twitter worked to block access to internal resources via the SSRF
vulnerability, specifically adding protections against internal service
enumeration.
 Input validation and whitelisting of acceptable URLs were implemented
to ensure that only legitimate and safe requests were allowed.

Report by Komalseerut Kaur

5. Facebook – SSRF Exploiting Internal File Systems
Year: 2019
Company: Facebook
Vulnerability: SSRF leading to internal file inclusion
Impact: Exposure of configuration files
Scenario:
Facebook discovered that an SSRF vulnerability allowed attackers to send
requests to internal services. The attacker used SSRF to interact with an internal
file system or a service and access sensitive files like configuration files, which
contained private information.
Impact:
This SSRF vulnerability could have been leveraged to gain access to critical
files and secrets, such as API keys, user data, or server configurations, which
could further escalate the attack.
Mitigation:
 Facebook enhanced its firewall rules and implemented more stringent
access controls to prevent servers from making requests to internal
resources.
 Input sanitization and blacklisting of internal IP ranges were added to
prevent the attacker from sending malicious requests to private addresses.

6. Alibaba Cloud – SSRF Targeting Instance Metadata

Year: 2020
Company: Alibaba Cloud
Vulnerability: SSRF targeting metadata service for cloud instances
Impact: Unauthorized access to instance metadata
Scenario:
An attacker exploited an SSRF vulnerability in Alibaba Cloud’s services. The
attack was executed by crafting a payload to trigger requests to the cloud
metadata service of an Alibaba Cloud instance. The metadata service contained
valuable information, such as instance credentials and API tokens.

Report by Komalseerut Kaur

Impact:
The attacker could have obtained sensitive metadata information, including
access tokens or other credentials, potentially gaining further access to the
cloud infrastructure or escalating the attack.
Mitigation:
 Alibaba Cloud implemented restrictions to block access to the instance
metadata service from external servers.
 Enhanced security measures were put in place to prevent metadata service
exposure, including instance isolation and stricter authentication for
sensitive data.

What is the impact of this issue?

1. Data Exfiltration: Attackers may be able to gain access to private
internal resources that are not intended for public consumption thanks to
SSRF vulnerabilities. Attackers can obtain important data, including
database credentials, API keys, or internal configuration files, by
submitting specially constructed queries through the susceptible server.
This data can be used to intensify attacks, like gaining access to private
user information, obtaining confidential data, or further weakening the
system. Organizations frequently experience financial losses, reputational
harm, and regulatory violations as a result of such breaches.

2. Unauthorized Access to Internal Systems: Internal systems are

frequently shielded from direct internet access by firewalls or network
access controls. However, by submitting requests on the server's behalf, a
successful SSRF attack can get beyond these safeguards. This gives
attackers access to restricted admin panels, corporate APIs, and other
private web apps that manage vital functions or hold sensitive data. This
illegal access poses a serious risk to the company since it can be used for
data theft, privilege escalation, or service interruption.

3. Exploiting Cloud Metadata Services: Instance metadata endpoints,

which offer essential details about the cloud instance, including security
tokens, IAM roles, and instance configurations, are exposed by
contemporary cloud environments including AWS, Google Cloud, and

Report by Komalseerut Kaur

 Microsoft Azure. Because they allow attackers to query metadata services
and retrieve credentials or tokens that provide access to cloud resources,
SSRF vulnerabilities are especially serious in these situations. Once
acquired, these credentials have the potential to compromise the entire
cloud environment by being used to exfiltrate sensitive data, deploy
malicious applications, or alter cloud infrastructure.

4. Internal Port Scanning: Internal network reconnaissance can also be

carried out by taking advantage of SSRF vulnerabilities. Attackers are
able to map the network, find open ports, and identify services that are
operating by submitting requests to different internal IP addresses and
ports. Attackers can use this information to plan additional exploitation,
such as focusing on devices or services that are susceptible. Because
SSRF circumvents exterior network security measures and gives attackers
access to otherwise concealed systems and services, internal port
scanning is especially dangerous.

Report by Komalseerut Kaur

 SECURITY MISCONFIGURATION

What is Security Misconfiguration?

Security misconfiguration is a vulnerability that occurs when a system,
application, network, or device is improperly configured or maintained in an
insecure state, making it vulnerable to exploitation. This could happen due to
the use of default settings, incomplete configurations, overly permissive access
controls, or the failure to update systems and software. Security
misconfigurations can arise at any layer of the application stack, from the
operating system and database to the application code and cloud services.
How It Happens
A number of things can lead to security misconfiguration. Here are some of the
causes:
1. Use of Default Settings
Many systems and software come with default configurations that prioritize
ease of use over security. For instance:
 Default usernames and passwords (e.g., admin/admin) are not changed
after deployment.
 Default security rules are left unchanged, leaving the system vulnerable
to attacks.

Report by Komalseerut Kaur

2. Lack of Regular Updates
 Outdated systems or software with known vulnerabilities remain
unpatched, exposing them to exploitation.
 Failure to apply security patches in a timely manner can allow attackers
to exploit these flaws.
3. Inadequate Access Controls
 Granting excessive permissions or roles to users and services leads to
unauthorized access.
 Mismanagement of role-based access control (RBAC) or failing to follow
the Principle of Least Privilege increases attack surfaces.
4. Improper Error Handling
 Detailed error messages, such as stack traces or database connection
details, are exposed to users, revealing sensitive information to attackers.
 Misconfigured error handling mechanisms often provide clues for further
exploitation.
5. Exposed Services
 Leaving unnecessary services, APIs, or features enabled in production
environments.
 For example, enabling directory listing on a web server or running
debugging tools on public-facing systems.

Vulnerabilities under Security Misconfiguration

1. Default Credentials
 Using default usernames and passwords (e.g., admin/admin) that come
preconfigured in software, systems, or devices.
 Attackers can easily exploit this to gain unauthorized access.

2. Open Directory Listings

 Web servers or directories configured to allow directory listing expose
sensitive files (e.g., configuration files, source code, or backups).

Report by Komalseerut Kaur

  Attackers can browse the exposed directories and identify critical files to
exploit.

3. Verbose Error Messages

 Displaying detailed error messages that reveal:
o Server information (e.g., server type, version).
o Stack traces or database details.
 These messages give attackers insights into the system's architecture and
potential vulnerabilities.

4. Unnecessary Features Enabled

 Features like debugging tools, sample files, or testing environments left
enabled in production.
 For instance:
o Debug mode exposing sensitive information like environment
variables.
o Sample applications or pages that include known vulnerabilities.

5. Misconfigured Security Headers

 Failing to set or misconfiguring HTTP security headers:
o Content-Security-Policy (CSP): Prevents Cross-Site Scripting
(XSS).
o Strict-Transport-Security (HSTS): Enforces HTTPS.
o X-Frame-Options: Protects against clickjacking attacks.

7. Outdated or Unpatched Software

 Running software or frameworks with known vulnerabilities due to
missed updates or patches.

Report by Komalseerut Kaur

  This allows attackers to exploit publicly disclosed vulnerabilities.

CASE STUDIES:

1. Capital One Data Breach (2019)

Impact: Over 100 million records of customer data exposed, including Social
Security Numbers and bank account information.
 Root Cause:
A misconfigured AWS S3 bucket allowed an attacker to exploit a poorly
configured web application firewall (WAF) to access sensitive data stored
in the cloud.
 Details:
The attacker used a Server-Side Request Forgery (SSRF) attack to exploit
metadata APIs of the cloud service. Capital One failed to implement
proper access controls and monitoring for their cloud resources.
 Takeaway:
Ensure proper cloud configuration, use least privilege access, and
regularly audit cloud permissions and monitoring systems.

2. Uber API Keys Exposure (2016)

Impact: Personal information of 57 million users and 600,000 drivers was
exposed.
 Root Cause:
Hardcoding of sensitive API keys and credentials into source code stored
in a publicly accessible GitHub repository.
 Details:
Attackers gained access to Uber’s private data by extracting credentials
from the GitHub repository, which were then used to breach Uber’s
systems hosted on AWS.

Report by Komalseerut Kaur

  Takeaway:
Avoid hardcoding sensitive information; instead, use secure storage
solutions like secret management tools or vaults.

3. Mossack Fonseca (Panama Papers Leak, 2016)

Impact: Leak of 11.5 million documents containing sensitive financial and
legal information of clients worldwide.
 Root Cause:
Outdated software on their servers:
o Drupal CMS was outdated and unpatched.
o Apache servers were running without proper security
configurations.
 Details:
The attackers exploited vulnerabilities in the outdated CMS to gain access
to the firm's systems, exposing decades of sensitive data.
 Takeaway:
Regularly update and patch software to prevent exploitation of known
vulnerabilities.

4. Australian Broadcasting Corporation (ABC) Cloud Leak (2018)

Impact: Sensitive data, including thousands of emails and login credentials,
was exposed publicly.
 Root Cause:
Misconfigured AWS S3 bucket left sensitive files accessible to the
public.
 Details:
The lack of access restrictions on the cloud storage allowed anyone with
the URL to download internal files.
 Takeaway:
Implement strict access controls on cloud storage services and conduct
routine security checks.

Report by Komalseerut Kaur

5. Marriott Data Breach (2018)
Impact: Compromise of 500 million guest records, including names,
addresses, passport numbers, and credit card details.
 Root Cause:
Misconfigured database systems and inadequate security controls
allowed attackers to access guest data over four years.
 Details:
Attackers exploited database misconfigurations to maintain persistence
and exfiltrate data undetected. Marriott also failed to implement proper
encryption for sensitive data.
 Takeaway:
Encrypt sensitive data at rest and in transit, and perform regular database
security audits.

6. NASA Cloud Misconfiguration (2019)

Impact: Sensitive project files and staff credentials were leaked.
 Root Cause:
Misconfigured Google Cloud Platform (GCP) storage bucket allowed
unauthorized access to sensitive files.
 Details:
Researchers found that NASA had accidentally left cloud storage
resources unprotected, exposing internal project details.
 Takeaway:
Enforce strict access policies and regularly scan cloud environments for
misconfigurations.

Report by Komalseerut Kaur

IMPACT OF SECURITY MISCONFIGURATION
Security misconfiguration can have severe consequences for organizations and
individuals, affecting data confidentiality, system integrity, and overall trust.
Below is a overview of some of the potential impacts:
1. Data Breaches
 Explanation: Misconfigured systems often expose sensitive data such as
customer information, financial records, and intellectual property.
Attackers can exploit this to gain unauthorized access to databases, cloud
storage, or file systems.
 Example Impact:
o Exposed personally identifiable information (PII) can lead to
identity theft.
o Business-sensitive data leaks can result in competitive
disadvantage or legal consequences.

Report by Komalseerut Kaur

2. Financial Loss
 Explanation: Organizations may face significant financial repercussions
due to fines, lawsuits, and the cost of remediation. Additionally, breaches
can lead to revenue loss from operational disruptions or customer
attrition.
 Example Impact:
o Non-compliance fines under regulations like GDPR or HIPAA.
o Ransomware attacks exploiting misconfigured systems can demand
hefty payments.

3. System Compromise
 Explanation: Misconfigurations can provide attackers with unauthorized
access to systems, enabling them to install malware, execute malicious
code, or disrupt services.
 Example Impact:
o Attackers can compromise critical infrastructure, leading to
operational downtime.
o Malware can propagate through systems, affecting other
applications and networks.

4. Reputational Damage
 Explanation: A publicized security misconfiguration can tarnish an
organization’s reputation, eroding customer trust and investor confidence.
 Example Impact:
o Customers may move to competitors due to a perceived lack of
security.
o Loss of trust can lead to declining stock prices for publicly traded
companies.

5. Loss of Competitive Advantage

Report by Komalseerut Kaur

  Explanation: Misconfigurations exposing proprietary or confidential
information can result in competitors gaining unauthorized insights.
 Example Impact:
o Exposure of trade secrets or intellectual property can undermine an
organization’s competitive position.

6. Unauthorized Resource Usage

 Explanation: Misconfigured systems may allow attackers to exploit
resources for their benefit, such as hosting malicious content or mining
cryptocurrency.
 Example Impact:
o Increased operational costs due to excessive resource usage.
o Hosting malicious content can lead to blacklisting or reputational
harm.

7. Escalation of Privileges
 Explanation: Excessive permissions due to misconfigurations can allow
attackers to escalate privileges and gain control over critical systems.
 Example Impact:
o Attackers can gain admin-level access, leading to full system
compromise.
o Unauthorized access to sensitive systems increases the scope of the
attack.

8. Exploitation of Cloud Environments

 Explanation: Misconfigured cloud services can expose sensitive data or
infrastructure. Cloud environments are especially vulnerable due to their
scale and complexity.
 Example Impact:
o Exposed storage buckets can lead to data theft.

Report by Komalseerut Kaur

 o Misconfigured APIs can result in unauthorized access or denial-of-
service attacks.

9. Legal and Compliance Risks

 Explanation: Security misconfigurations often lead to non-compliance
with regulatory requirements, resulting in legal action or penalties.
 Example Impact:
o Non-compliance with GDPR can result in fines up to 4% of annual
revenue.
o Breach notifications and investigations can incur additional costs.

10. Increased Vulnerability to Future Attacks

 Explanation: Misconfigured systems create a weak security posture,
making them prime targets for future attacks.
 Example Impact:
o Once exposed, attackers may repeatedly target vulnerable systems.
o Successful exploits can lead to long-term security challenges.

REFERENCES:
1. [Link]
2. [Link]
Side_Request_Forgery_%28SSRF%29/
3. [Link]
exploiting-chained-vulnerabilities-78f290ae9011
4. [Link]
5. [Link]
6. [Link]
7. [Link]
misconfiguration
8. [Link]

Report by Komalseerut Kaur