The application lets users specify a URL for their profile picture. It fetches the data from the URL and saves it on the server. However, the app is vulnerable to server-side request forgery (SSRF) - you can specify URLs like
file:///etc/passwd and also access local HTTP services like
What's the best way to fix this? Some ideas I had:
- Restrict the URL protocol to HTTP and HTTPS.
- DNS lookup the host name and check it's not a local address.
- Disable redirects.
This seems a good start - although there's a TOCTOU issue with the DNS lookup (may be ok in practice, as local DNS will cache).
An alternative idea I had was to place a proxy in a restricted network segment, where it can only see the Internet, and send requests through that.
I did research this online, but there's not much information. This article is pretty good.