This is a follow up of another topic (https://security.stackexchange.com/questions/95650/is-allowing-unfiltered-curl-request-from-a-website-a-vulnerability) on which I am doing some private research. Given: > A publicly reachable webservice that accepts any url and > performs a curl get request on it. The service operates without authentication. The linked topic already states that unfiltered access is a security issue. But something on this topic surfaces my thoughts periodically and it took me a while to think about: Can such a service made sufficiently secure against SSRF and alike? ------- Obvious steps: * cURL is mighty, restrict allowed schemes to http(s) and ftp (solves *file, gopher, dict, etc.* issues) * prevent access to entire loopback: *localhost*, 127.0.0.1-127.0.0.255 (I was totally unaware that the entire network of 127.x.x.x points to your machine 0_o) * prevent access to 0.0.0.0 * disallow broadcast IP 255.255.255.255 (although unlikely that something serves anything on the allowed schemes above) * prevent private IPs to avoid access to internal networks (impersonalization of a server, which is part of the private network?) -> 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 (thanks [wiki][1]) ------ But there is more, right? * if cURL is configured to follow redirects, the redirect must be validated the same way as the original IP, since forging a redirect is trivial * IPv6: Everything for the nice old IPv4 address space must be redone there too, right? * Are there some ports to filter by? Remember schemes are restricted to http(s) and ftp. This may still technically be a port scanner but not necessary malicious but getting a website from port 675 might be ok. * Prevent DoS remote urls: Implement some sort of token (CSRF token alike), introduce timeouts between multiple requests, say 1 second or ban IPs which keep hammering. (Does of course not solve DDoS, but preventing DDoS is probably outside of the scope here) ----- One last thing I cannot fully get my head around: What's with **DNS**? Is it possible to register a DNS entry to point to localhost or private networks? On my machine I technically can perform a GET of `http://my.box` and get my router. Now how can somebody mitigate that risk? Is performing a `nslookup` a solution? If I get an IP, validate the IP. If not, it may be anything, deny. I keep forgetting what my NAS does so I can reach it via host name in my local network, but being paranoid is probably a good way here. [1]: https://en.wikipedia.org/wiki/Private_network