What SSRF is and how to protect your web app against this type of attack

SSRF occurs when an application allows users to supply a URL or other request parameters, which the server then uses to make HTTP or other network requests. An attacker manipulates these inputs to force the server to send requests to resources that the attacker shouldn’t have access to, such as:

1. Internal Resources:

• Internal services like databases (http://127.0.0.1:3306).

• Internal APIs, admin panels, or other services running on private IP ranges (10.x.x.x, 192.168.x.x, etc.).

• Cloud metadata endpoints (http://169.254.169.254/latest/meta-data), exposing sensitive information like AWS credentials.

2. External Resources:

• Malicious websites controlled by the attacker to exfiltrate sensitive data.

• Services vulnerable to Denial of Service (DoS) attacks.

Now lets look at a vulnerable code and see how we can remediate it.

To remediate SSRF (Server-Side Request Forgery) in a Node.js and Express application, you need to validate user inputs, restrict the server’s ability to make unauthorized network requests, and implement security best practices.

Here’s how you can secure your application step-by-step:

1. Vulnerable Code Example

const express = require('express');
const fetch = require('node-fetch');
const app = express();

app.use(express.json());

// Vulnerable endpoint: directly fetches user-supplied URLs
app.post('/fetch-data', async (req, res) => {
    const { url } = req.body;

    if (!url) {
        return res.status(400).send('URL is required');
    }

    try {
        const response = await fetch(url);
        const data = await response.text();
        res.status(200).send(data);
    } catch (err) {
        res.status(500).send('Failed to fetch the URL');
    }
});

app.listen(3000, () => console.log('Server running on http://localhost:3000'));

2. Securing the Code

Here’s a secure version of the same endpoint, incorporating multiple layers of protection:

const express = require('express');
const fetch = require('node-fetch');
const { URL } = require('url'); // Built-in Node.js module for URL validation
const app = express();

app.use(express.json());

// Define trusted domains (whitelist)
const ALLOWED_DOMAINS = ['example.com', 'trusted.com'];

// Function to validate URLs
function validateUrl(inputUrl) {
    try {
        const parsedUrl = new URL(inputUrl);

        // Check if the protocol is HTTP or HTTPS
        if (!['http:', 'https:'].includes(parsedUrl.protocol)) {
            throw new Error('Invalid protocol');
        }

        // Check if the hostname is in the allowed list
        if (!ALLOWED_DOMAINS.includes(parsedUrl.hostname)) {
            throw new Error('Domain not allowed');
        }

        return parsedUrl.href;
    } catch (err) {
        return null;
    }
}

// Secure endpoint
app.post('/fetch-data', async (req, res) => {
    const { url } = req.body;

    if (!url) {
        return res.status(400).send('URL is required');
    }

    // Validate the URL
    const validatedUrl = validateUrl(url);
    if (!validatedUrl) {
        return res.status(400).send('Invalid or disallowed URL');
    }

    try {
        // Fetch the validated URL
        const response = await fetch(validatedUrl, {
            timeout: 5000, // Set a timeout to prevent hanging requests
        });
        const data = await response.text();
        res.status(200).send(data);
    } catch (err) {
        console.error('Error fetching data:', err);
        res.status(500).send('Failed to fetch the URL');
    }
});

app.listen(3000, () => console.log('Secure server running on http://localhost:3000'));

Key Security Measures in the Code

1. Input Validation:

• Use the URL class to parse and validate user-supplied URLs.

• Restrict allowed protocols to http and https.

• Implement an allowlist (ALLOWED_DOMAINS) for trusted domains.

2. Timeouts:

• Set a timeout for fetch requests to prevent the server from hanging indefinitely.

3. Reject Internal IP Addresses (Optional): Add additional checks to block internal IP ranges such as 127.0.0.1 or 10.0.0.0/8.

const isInternalIp = (hostname) => /^(127\.|10\.|192\.168\.)/.test(hostname);
if (isInternalIp(parsedUrl.hostname)) {
    throw new Error('Access to internal IPs is not allowed');
}

4. Error Handling:

• Gracefully handle errors from fetch (e.g., network errors, invalid URLs).

• Avoid exposing sensitive server information in error messages.

5. Logging and Monitoring:

• Log suspicious or blocked requests for auditing and debugging purposes.

console.warn(`Blocked request to: ${url}`);

3. Enhancing Security with Additional Tools

   • Network-Level Restrictions:

   • Use firewalls or cloud-based security rules (e.g., AWS Security Groups) to block requests to sensitive internal services.

4. • Rate Limiting:

5. • Prevent abuse by limiting the number of requests per user.

const rateLimit = require('express-rate-limit');
const limiter = rateLimit({
    windowMs: 15 * 60 * 1000, // 15 minutes
    max: 100, // Limit each IP to 100 requests per window
});
app.use(limiter);

• Use Third-Party Libraries:

• Libraries like safe-url-input can simplify URL validation.

4. Example Testing Scenarios

To test the security of this endpoint: 1. Allowed Domain:

curl -X POST http://localhost:3000/fetch-data 
-H "Content-Type: application/json" 
-d '{"url":"http://example.com"}'

2. Disallowed Domain:

curl -X POST http://localhost:3000/fetch-data 
-H "Content-Type: application/json" 
-d '{"url":"http://malicious.com"}'

3. Internal Resource Access (should be blocked):

curl -X POST http://localhost:3000/fetch-data 
-H "Content-Type: application/json" 
-d '{"url":"http://127.0.0.1:3306"}'

By implementing these safeguards, your Node.js and Express application will be well-protected against SSRF attacks while maintaining functionality for legitimate users.