0

In our web app the users can specify a URL that the server will access later (POP3 access and browser push notifications).

This means the web app does a network request to a user-chosen server. The web server might have access to parts of our internal network or some services might be running on localhost.

              +------------------+                  
              |                  |                  +------------------+
internet  ----+     web server   +----[Firewall]----+ internal network |
              |                  |                  +------------------+
              +------------------+

What is the best way to prevent users from specifying internal URLs and only specifying servers accessible through the external internet?

Improve this question
2
  • Why not resolve only external domain names and not hostnames, IP addresses and internal names?
    – user163495
    Nov 17, 2020 at 14:44
  • @mentallurg that question is about CSRF, this one is about SSRF.
    – multithr3at3d
    Nov 20, 2020 at 23:53

1 Answer 1

Reset to default
2

... prevent users from specifying internal URLs and only specifying servers accessible through the external internet?

I doubt that this is securely possible to proactively filter user input for this. An attacker can easily setup a DNS server which points to some internal IP address or domain, either by A/AAAA record or by CNAME. And given that this DNS server is controlled by the attacker the result of the DNS resolution might be changed whenever the attacker likes.

This means that to check only when entering the domain is not sufficient. Instead the check need to be done whenever the service uses the user-controlled data, i.e. whenever the user-specified URL is accessed and the domain name gets resolved in this process. See also Time-of-check to time-of-use bugs.

The web server might have access to parts of our internal network or some services might be running on localhost.

It might be easier and more secure to fix this design. For example one might put the service inside a container with no other services inside and allow only access to the internet for this container. This approach would provide robustness even against bugs in the application since by design no access to internal sites would be possible.

Another (less secure) option would be to setup a DNS resolver like dnswall which only returns external IP addresses and make sure that only this server is used by the application. Of course one need also be sure that no direct IPv4 or IPv6 can be specified by the user. A similar approach is to enforce the use of an external proxy server which just based on its location can only access external sites.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .