Server-Side Request Forgery RCA

Server-Side Request Forgery

• Input Validation
  • Improper regex or whitelist usage
  • Bypass via URL encoding or redirects
  • Lack of URL input sanitization
  • Direct user input used in requests
• Application Design
  • Exposes internal services to untrusted input
  • Cloud metadata endpoint accessible
  • Application fetches external resources
  • No restrictions on destination IPs or domains
• Server Configuration
  • Default firewall rules allow outbound traffic
  • No egress filtering in place
  • No network segmentation
  • Internal services accessible from app server
• Logging and Monitoring
  • Alerts not configured for unusual outbound traffic
  • Lack of request logging
  • No traceability for internal access
• Testing and QA
  • No SSRF-specific testing in CI/CD
  • Lack of automated dynamic security scans
  • No security testing on internal endpoints
  • Internal APIs not part of test cases
• Organizational Controls
  • Absence of security design reviews
  • SSRF risks not documented during design
  • Developers lack SSRF awareness
  • No training on server-side attack vector

Suggested Actions Checklist

Here are some corrective actions, preventive actions and investigative actions that organizations may find useful:

• Input Validation
  • Improper regex or whitelist usage
    • Corrective Actions:
    • Review and fix existing regular expressions and whitelists used for input validation to ensure comprehensive coverage of valid formats and rejection of harmful input.
    • Preventive Actions:
    • Establish coding standards for secure regex and whitelist implementations with peer review requirements.
    • Investigative Actions:
    • Audit past input validation implementations to identify common regex/whitelist misuse patterns.
  • Lack of URL input sanitization
    • Corrective Actions:
    • Implement robust URL sanitization and validation logic for all user inputs used in HTTP requests.
    • Preventive Actions:
    • Integrate a security library for URL validation as part of development frameworks.
    • Investigative Actions:
    • Review all points in the codebase where user input is used in URL construction to identify sanitization gaps.
• Application Design
  • Exposes internal services to untrusted input
    • Corrective Actions:
    • Implement access control rules that restrict internal service communication based on trust boundaries.
    • Preventive Actions:
    • Introduce threat modeling in the design phase to account for internal service exposure risks.
    • Investigative Actions:
    • Map the flow of untrusted input to internal services and identify any unauthorized access patterns.
  • Application fetches external resources
    • Corrective Actions:
    • Restrict external resource fetching to a fixed list of trusted domains.
    • Preventive Actions:
    • Implement an allowlist policy for outbound HTTP requests.
    • Investigative Actions:
    • Analyze logs to identify patterns of external resource access and verify their legitimacy.
• Server Configuration
  • Default firewall rules allow outbound traffic
    • Corrective Actions:
    • Harden firewall configurations to block all outbound traffic by default, allowing only specific destinations.
    • Preventive Actions:
    • Include firewall configuration checks in deployment automation.
    • Investigative Actions:
    • Examine firewall rule sets across environments to identify over-permissive defaults.
  • No network segmentation
    • Corrective Actions:
    • Introduce logical segmentation of the network to isolate internal services from the application server.
    • Preventive Actions:
    • Design all new deployments with segmented network architecture using VLANs or subnets.
    • Investigative Actions:
    • Conduct a network architecture review to locate cross-boundary communication paths.
• Logging and Monitoring
  • Alerts not configured for unusual outbound traffic
    • Corrective Actions:
    • Configure alerting mechanisms for anomalous outbound request patterns.
    • Preventive Actions:
    • Establish baseline traffic profiles and build detection rules in SIEM tools.
    • Investigative Actions:
    • Analyze historical traffic to identify missed opportunities for alerting.
  • Lack of request logging
    • Corrective Actions:
    • Enable detailed request logging for all inbound and outbound HTTP/S traffic.
    • Preventive Actions:
    • Make logging mandatory in application design and coding standards.
    • Investigative Actions:
    • Determine the visibility gaps by evaluating incidents where logs were unavailable.
• Testing and QA
  • No SSRF-specific testing in CI/CD
    • Corrective Actions:
    • Incorporate SSRF-specific test cases into the continuous integration/continuous deployment pipelines.
    • Preventive Actions:
    • Develop reusable security testing modules that target SSRF vectors.
    • Investigative Actions:
    • Review past pipeline test results to identify gaps related to SSRF.
  • No security testing on internal endpoints
    • Corrective Actions:
    • Include internal endpoints in the security testing scope using internal scanning tools.
    • Preventive Actions:
    • Update testing policies to require internal endpoint coverage.
    • Investigative Actions:
    • Conduct a threat assessment on internal endpoints to estimate risk exposure.
• Organizational Controls
  • Absence of security design reviews
    • Corrective Actions:
    • Establish a formal process for security design reviews as part of the development lifecycle.
    • Preventive Actions:
    • Require security sign-off for all high-risk feature deployments.
    • Investigative Actions:
    • Examine past architecture changes that were not subjected to security review.
  • Developers lack Server-Side Request Forgery awareness
    • Corrective Actions:
    • Organize targeted workshops on Server-Side Request Forgery vulnerabilities and remediation.
    • Preventive Actions:
    • Add Server-Side Request Forgery topics to developer onboarding and regular training schedules.
    • Investigative Actions:
    • Conduct developer surveys or interviews to gauge current knowledge levels.