High ThreatCloud & Container SecurityCWE-918
Server-Side Request Forgery Defense: Cloud Metadata
Prevent SSRF attacks by implementing strict private IP filtering and securing cloud metadata endpoints from internal request forgery.
Vulnerability Overview
SSRF allows attackers to make the server perform requests to internal resources.
By providing an internal URL, attackers bypass firewalls.
Vulnerable Code
requests.get(user_input_url)Fetches arbitrary URLs.
Remediated Code
if not is_private(user_input_url): requests.get(user_input_url)Validates URL is external.
Hardening Rules
- 1Block private IP ranges
- 2Disable redirects
- 3Require IMDSv2
Frequently Asked Questions
What is IMDSv2?
AWS metadata service v2 which requires session tokens, preventing simple SSRF.