1

If I have a an application server that uses an implementation of JAX-RS, and is running as *.war file on an Apache Tomcat server, is there anything special that needs to be done or configured to prevent SSRF attacks?

My naive understanding is that JAX-RS application are only serving requests to certain URLs and Apache Tomcat only allows requests to certain resources.

If this is handled by default by JAX-RS or Apache Tomcat, could you explain how?

If this is not handled by default by JAX-RS nor Apache Tomcat, could you explain the best way to prevent this type of attack with these tools?

Specific versions:

  • JAX-RS api 2.1
  • Apache Tomcat 9.0.33
Improve this question
6
  • Is your JAX-RS application requesting data from other applications based on the user input? – bhorkarg Apr 21 '20 at 8:35
  • @bhorkarg I have one application that sits on top of a database and one that does make a request to another application for data based on an identifier that the client system passes in. The two flows look something like this: User -> Client System -> My Application -> (Database || Downstream Application) – iraleigh Apr 21 '20 at 17:46
  • If the identifier is a url or a hostname of the downstream application, then you should validate it (and keep a whitelist) to prevent SSRF. – bhorkarg Apr 23 '20 at 11:41
  • As far as the question is concerned, there is no mention of SSRF prevention in tomcat documentation so I would assume there is no default protection. Anyways, SSRF is quite dependent on the application logic, so I would put more focus on building the protections on the app level itself. – bhorkarg Apr 23 '20 at 11:42
  • 1
    @SundeepPidugu I haven't found anything online specifically addressing SSRF. One of the apps I work on got dinged, by our App Sec team, for not addressing it. But our App Sec Champion did not have any advice on preventing it given our tech stack. If I find anything specific, I will update the question/answer--for now I accepted the answer that mentions there is no protection by default. – iraleigh Aug 25 '20 at 18:55
3

Neither Tomcat nor JAX-RS documentation mentions anything to prevent SSRF attacks. So I would assume there is no protection by default.

SSRF typically abuses the trust placed in a server by other entities. Which is why in your case it is important to vet the vectors used for connections initiated from the server. So validate your input. For example, if your server depends on a user supplied URL to fetch something, then validate that URL and allow only the target hosts that you trust and block localhost.

OWASP has a cheatsheet for SSRF and gives a pretty good overview of protection methods.

Improve this answer
1
  • Thanks for your answer and the link to OWASP – iraleigh Apr 24 '20 at 0:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.