Unvalidated query parameters

Oct 13, 2025 by wbrum.org 135 views

What is Server-Side Request Forgery (SSRF)?

Server-Side Request Forgery (SSRF) is a type of web application vulnerability that allows an attacker to inject malicious requests to internal systems or services, potentially leading to unauthorized data access, data tampering, or even lateral movement within the network. This vulnerability occurs when a web application fails to properly validate or sanitize user input, allowing an attacker to manipulate the application's requests to internal systems.

How is SSRF Created?

SSRF vulnerabilities are often created due to a lack of proper input validation and sanitization in web applications. When a web application receives user input, it may use this input to construct requests to internal systems or services. If the input is not properly validated or sanitized, an attacker can inject malicious requests, leading to SSRF.

Here are some common scenarios that can lead to SSRF vulnerabilities:

Unvalidated redirects: When a web application redirects the user to an internal system or service without validating the URL, an attacker can inject a malicious URL, leading to SSRF.
Unvalidated HTTP headers: When a web application uses user input to construct HTTP headers, an attacker can inject malicious headers, leading to SSRF.
Unvalidated query parameters: When a web application uses user input to construct query parameters, an attacker can inject malicious query parameters, leading to SSRF.

Practical Example: Vulnerable Endpoint

Let's consider a simple example of a vulnerable endpoint that is susceptible to SSRF attacks. We will create a Node.js application with an endpoint that takes a URL as input and makes a GET request to that URL.

const express = require('express');
const app = express();

app.get('/ssrf', (req, res) => {
    const url = req.query.url;
    const options = {
        method: 'GET',
        url: url,
        headers: {
            'User-Agent': 'Mozilla/5.0'
        }
    };

    const axios = require('axios');
    axios(options)
        .then(response => {
            res.send(response.data);
        })
        .catch(error => {
            res.status(500).send(error.message);
        });
});

app.listen(3000, () => {
    console.log('Server listening on port 3000');
});

In this example, the /ssrf endpoint takes a url query parameter and makes a GET request to that URL using the axios library. This endpoint is vulnerable to SSRF attacks because it does not properly validate the url query parameter.

Postman Files: Interacting with the Vulnerable Endpoint

To interact with the vulnerable endpoint, we can use Postman to send a GET request with a malicious URL as the url query parameter. Here is an example of a Postman file that demonstrates this:

{
    "info": {
        "_postman_id": "b7f4f4f4-4f4f-4f4f-4f4f-4f4f4f4f4f4f",
        "_postman_collection_id": "b7f4f4f4-4f4f-4f4f-4f4f-4f4f4f4f4f4f",
        "_postman_token_id": null,
        "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json"
    },
    "item": [
        {
            "name": "SSRF Vulnerability",
            "request": {
                "method": "GET",
                "header": [
                    {
                        "key": "User-Agent",
                        "value": "Mozilla/5.0"
                    }
                ],
                "url": {
                    "raw": "http://localhost:3000/ssrf?url=http://localhost:3000/ssrf",
                    "host": [
                        "localhost"
                    ],
                    "port": "3000",
                    "path": [
                        "ssrf"
                    ]
                },
                "query": [
                    {
                        "key": "url",
                        "value": "http://localhost:3000/ssrf"
                    }
                ]
            },
            "response": []
        }
    ]
}

In this example, the Postman file sends a GET request to the /ssrf endpoint with a malicious URL as the url query parameter. This malicious URL points to the same endpoint, which will cause the application to make a recursive request to itself, leading to a stack overflow error.

Example Endpoint: Remediation

To remediate the SSRF vulnerability, we need to properly validate and sanitize the url query parameter. Here is an example of a remediated endpoint:

const express = require('express');
const app = express();

app.get('/ssrf', (req, res) => {
    const url = req.query.url;
    const allowedUrls = ['http://example.com', 'https://example.com'];

    if (allowedUrls.includes(url)) {
        const options = {
            method: 'GET',
            url: url,
            headers: {
                'User-Agent': 'Mozilla/5.0'
            }
        };

        const axios = require('axios');
        axios(options)
            .then(response => {
                res.send(response.data);
            })
            .catch(error => {
                res.status(500).send(error.message);
            });
    } else {
        res.status(400).send('Invalid URL');
    }
});

app.listen(3000, () => {
    console.log('Server listening on port 3000');
});

In this example, the /ssrf endpoint checks if the url query parameter is in the list of allowed URLs. If it is, the endpoint makes a GET request to that URL. If it is not, the endpoint returns a 400 error.

SSRF Exploit Explanation

The SSRF exploit in this example works by injecting a malicious URL as the url query parameter. This malicious URL points to the same endpoint, which will cause the application to make a recursive request to itself, leading to a stack overflow error.

Here is an example of a malicious URL that can be used to exploit the SSRF vulnerability:

http://localhost:3000/ssrf?url=http://localhost:3000/ssrf

This malicious URL points to the /ssrf endpoint with a url query parameter that points to the same endpoint. When the application receives this request, it will make a recursive request to itself, leading to a stack overflow error.

SSRF Mitigation and Remediation Recommendations

To mitigate and remediate SSRF vulnerabilities, follow these recommendations:

Validate and sanitize user input: Always validate and sanitize user input to prevent malicious requests from being injected into the application.
Use allowed URLs: Only allow specific URLs to be accessed by the application. This can be done by maintaining a list of allowed URLs and checking if the requested URL is in that list.
Use a whitelist approach: Instead of using a blacklist approach, use a whitelist approach to only allow specific URLs to be accessed by the application.
Use a proxy server: Consider using a proxy server to intercept and validate requests made by the application.
Regularly update and patch dependencies: Regularly update and patch dependencies to prevent known vulnerabilities from being exploited.
Conduct regular security testing: Conduct regular security testing to identify and remediate vulnerabilities before they can be exploited.

Q: What is Server-Side Request Forgery (SSRF)?

A: Server-Side Request Forgery (SSRF) is a type of web application vulnerability that allows an attacker to inject malicious requests to internal systems or services, potentially leading to unauthorized data access, data tampering, or even lateral movement within the network.

Q: How does SSRF occur?

A: SSRF occurs when a web application fails to properly validate or sanitize user input, allowing an attacker to manipulate the application's requests to internal systems or services.

Q: What are some common scenarios that can lead to SSRF vulnerabilities?

A: Some common scenarios that can lead to SSRF vulnerabilities include:

Unvalidated redirects: When a web application redirects the user to an internal system or service without validating the URL, an attacker can inject a malicious URL, leading to SSRF.
Unvalidated HTTP headers: When a web application uses user input to construct HTTP headers, an attacker can inject malicious headers, leading to SSRF.
Unvalidated query parameters: When a web application uses user input to construct query parameters, an attacker can inject malicious query parameters, leading to SSRF.

Q: How can I identify SSRF vulnerabilities in my application?

A: To identify SSRF vulnerabilities in your application, you can use the following methods:

Code review: Conduct a thorough code review to identify any instances of unvalidated user input.
Penetration testing: Perform penetration testing to simulate attacks on your application and identify any vulnerabilities.
Static analysis tools: Use static analysis tools to scan your code for potential vulnerabilities.
Dynamic analysis tools: Use dynamic analysis tools to scan your application for potential vulnerabilities.

Q: How can I remediate SSRF vulnerabilities in my application?

A: To remediate SSRF vulnerabilities in your application, you can use the following methods:

Validate and sanitize user input: Always validate and sanitize user input to prevent malicious requests from being injected into the application.
Use allowed URLs: Only allow specific URLs to be accessed by the application. This can be done by maintaining a list of allowed URLs and checking if the requested URL is in that list.
Use a whitelist approach: Instead of using a blacklist approach, use a whitelist approach to only allow specific URLs to be accessed by the application.
Use a proxy server: Consider using a proxy server to intercept and validate requests made by the application.
Regularly update and patch dependencies: Regularly update and patch dependencies to prevent known vulnerabilities from being exploited.
Conduct regular security testing: Conduct regular security testing to identify and remediate vulnerabilities before they can be exploited.

Q: What are some best practices for preventing SSRF vulnerabilities?

A: Some best practices for preventing SSRF vulnerabilities include:

Use secure coding practices: Always use secure coding practices to prevent vulnerabilities from occurring.
Use input validation and sanitization: Always validate and sanitize user input to prevent malicious requests from being injected into the application.
Use a whitelist approach: Instead of using a blacklist approach, use a whitelist approach to only allow specific URLs to be accessed by the application.
Use a proxy server: Consider using a proxy server to intercept and validate requests made by the application.
Regularly update and patch dependencies: Regularly update and patch dependencies to prevent known vulnerabilities from being exploited.
Conduct regular security testing: Conduct regular security testing to identify and remediate vulnerabilities before they can be exploited.

Q: What are some common SSRF attack vectors?

A: Some common SSRF attack vectors include:

DNS rebinding: An attacker can use DNS rebinding to redirect the user to a malicious URL, potentially leading to SSRF.
HTTP header injection: An attacker can use HTTP header injection to inject malicious headers, potentially leading to SSRF.
Query parameter injection: An attacker can use query parameter injection to inject malicious query parameters, potentially leading to SSRF.

Q: How can I protect my application from SSRF attacks?

A: To protect your application from SSRF attacks, you can use the following methods:

Use secure coding practices: Always use secure coding practices to prevent vulnerabilities from occurring.
Use input validation and sanitization: Always validate and sanitize user input to prevent malicious requests from being injected into the application.
Use a whitelist approach: Instead of using a blacklist approach, use a whitelist approach to only allow specific URLs to be accessed by the application.
Use a proxy server: Consider using a proxy server to intercept and validate requests made by the application.
Regularly update and patch dependencies: Regularly update and patch dependencies to prevent known vulnerabilities from being exploited.
Conduct regular security testing: Conduct regular security testing to identify and remediate vulnerabilities before they can be exploited.