SSRF (Server-Side Request Forgery) and How to Prevent It

SSRF attack targets:
  http://169.254.169.254/latest/meta-data/iam/security-credentials/
    --> Leaks temporary IAM credentials (catastrophic)
  http://localhost:8080/admin
    --> Accesses internal admin panel
  http://10.0.0.5:5432/
    --> Reaches internal database
  file:///etc/passwd
    --> Reads local files (non-HTTP schemes)

package com.bank.vulnerability;

import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.net.URI;

public class VulnerableUrlFetcher {

    private static final HttpClient CLIENT = HttpClient.newHttpClient();

    // DANGEROUS: no validation on the URL
    public String fetch(String userUrl) throws Exception {
        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create(userUrl))
            .build();
        HttpResponse<String> response = CLIENT.send(request,
            HttpResponse.BodyHandlers.ofString());
        return response.body();
    }

    // Attacker calls: fetch("http://169.254.169.254/latest/meta-data/")
    // Server fetches the metadata endpoint and returns IAM credentials!
}

package com.bank.security;

import java.net.InetAddress;
import java.net.URI;
import java.util.Set;

public class SsrfValidator {

    private static final Set<String> ALLOWED_HOSTS = Set.of(
        "api.partner.com",
        "webhook.paymentgateway.com"
    );

    public boolean isAllowed(String url) throws Exception {
        URI uri = URI.create(url);

        // Step 1: Only allow https scheme
        if (!"https".equals(uri.getScheme())) {
            System.out.println("BLOCKED: non-HTTPS scheme: " + uri.getScheme());
            return false;
        }

        // Step 2: Host must be on the allowlist
        String host = uri.getHost();
        if (!ALLOWED_HOSTS.contains(host)) {
            System.out.println("BLOCKED: host not on allowlist: " + host);
            return false;
        }

        // Step 3: Resolve IP and check it is not private/internal
        InetAddress address = InetAddress.getByName(host);
        if (isPrivateOrReserved(address)) {
            System.out.println("BLOCKED: resolved to private IP: " + address);
            return false;
        }

        System.out.println("ALLOWED: " + url);
        return true;
    }

    private boolean isPrivateOrReserved(InetAddress addr) {
        return addr.isLoopbackAddress()    // 127.0.0.0/8
            || addr.isSiteLocalAddress()    // 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16
            || addr.isLinkLocalAddress();   // 169.254.0.0/16 (includes metadata)
    }

    public static void main(String[] args) throws Exception {
        SsrfValidator validator = new SsrfValidator();
        validator.isAllowed("https://api.partner.com/webhook");
        validator.isAllowed("http://169.254.169.254/latest/meta-data/");
        validator.isAllowed("https://evil.com/callback");
        validator.isAllowed("https://api.partner.com/internal");
    }
}

ALLOWED: https://api.partner.com/webhook
BLOCKED: non-HTTPS scheme: http
BLOCKED: host not on allowlist: evil.com
ALLOWED: https://api.partner.com/internal

DNS rebinding attack:
  1. Attacker registers evil.com
  2. First DNS lookup: evil.com --> 93.184.216.34 (public IP, passes check)
  3. Server opens connection
  4. Second DNS lookup (for the actual request): evil.com --> 169.254.169.254!
  5. Server connects to metadata endpoint

Defense: pin the resolved IP
  1. Resolve evil.com --> 93.184.216.34
  2. Check: is 93.184.216.34 private? No --> proceed
  3. Connect to 93.184.216.34 specifically (pinned)
  4. DNS rebinding cannot redirect the connection

package com.bank.security;

import java.net.http.HttpClient;
import java.net.http.HttpClient.Redirect;

public class SafeHttpClientConfig {

    // Disable automatic redirect following
    public HttpClient createSafeClient() {
        return HttpClient.newBuilder()
            .followRedirects(Redirect.NEVER) // do not auto-follow
            .build();
        // Manually handle redirects: validate each hop
    }
}

Defenses against metadata access:
  1. Block 169.254.169.254 in the egress proxy and firewall
  2. Use IMDSv2 (token-required): SSRF cannot issue the PUT request to get a token
  3. Validate resolved IPs: link-local range (169.254.0.0/16) is always blocked
  4. Run services with least-privilege IAM so even leaked credentials are limited

// WRONG: check hostname only
if (!url.contains("169.254") && !url.contains("localhost")) {
    httpClient.get(url); // DNS rebinding bypasses this!
}

// CORRECT: resolve and check IP
InetAddress addr = InetAddress.getByName(uri.getHost());
if (addr.isLoopbackAddress() || addr.isSiteLocalAddress()
        || addr.isLinkLocalAddress()) {
    throw new SecurityException("Blocked: internal address");
}