Lukas' Notes

Server-Side Request Forgery

1 min read

web security

Definition

Server-Side Request Forgery (CWE-918)

A server-side request forgery occurs when a server fetches a URL supplied (or influenced) by the client and uses the result. The attacker turns the server into a proxy that can make requests to destinations the attacker could not reach directly, escalating privileges or attacking other targets.

Typical targets:

  • http://127.0.0.1 or localhost — private internal APIs not exposed to the outside.
  • file:// — local files on the server.
  • Cloud metadata endpoints (169.254.169.254) — sensitive configuration and credentials.
  • Services behind a firewall, such as internal databases.
  • Public websites, masking the attacker’s origin.

URL validation is hard

A filter that rejects literal 127.0.0.1 is routinely bypassed, because the same host has many encodings (127.1, 2130706433, 0x7F000001), because a domain can point to localhost, because credentials can be embedded (https://x:pw@evil.com), because an open redirect can funnel an approved domain, and because tools accept curl brace syntax (https://{a,b}.com) and Unicode-normalised hosts. See URL validation is hard.

Backlinks