SSRF Protection

Protection Module: ServerSideRequestForgery

Prevents Server-Side Request Forgery (SSRF) attacks by validating and filtering outbound HTTP requests.

Available for:

• ASP.NET Core
• ASP.NET Framework
• Azure Functions

How It Works

SSRF Protection monitors outbound HTTP requests to prevent access to internal resources or unauthorized external services.

Detection Methods:

• Private IP Range Detection - Blocks requests to 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16
• Localhost Detection - Identifies 127.0.0.1, localhost, [::1]
• Cloud Metadata API Detection - Blocks AWS/Azure/GCP metadata endpoints
• URL Redirect Analysis - Validates redirect chains
• DNS Rebinding Prevention - Detects DNS time-of-check attacks
• Protocol Validation - Restricts to HTTP/HTTPS only

Protected Resources:

• AWS Metadata API (169.254.169.254)
• Azure Instance Metadata (169.254.169.254)
• GCP Metadata Server (metadata.google.internal)
• Kubernetes API (10.96.0.1)
• Internal network ranges
• Localhost services

Configuration

{
  "protections": {
    "ServerSideRequestForgery": {
      "enabled": true,
      "action": "block"
    }
  }
}

{
  "protections": {
    "ServerSideRequestForgery": {
      "enabled": true,
      "action": "block"
    }
  }
}

ASP.NET Core

builder.Services.AddBytehideMonitor(monitor => monitor
    .WithProtection(ProtectionModuleType.ServerSideRequestForgery, ActionType.Block)
);

builder.Services.AddBytehideMonitor(monitor => monitor
    .WithProtection(ProtectionModuleType.ServerSideRequestForgery, ActionType.Block)
);

Advanced Configuration

{
  "protections": {
    "ServerSideRequestForgery": {
      "enabled": true,
      "action": "block",
      "config": {
        "allowPrivateIPs": false,
        "allowLocalhost": false,
        "allowCloudMetadata": false,
        "allowedDomains": ["api.example.com"],
        "blockedDomains": ["internal.company.com"],
        "maxRedirects": 3
      }
    }
  }
}

{
  "protections": {
    "ServerSideRequestForgery": {
      "enabled": true,
      "action": "block",
      "config": {
        "allowPrivateIPs": false,
        "allowLocalhost": false,
        "allowCloudMetadata": false,
        "allowedDomains": ["api.example.com"],
        "blockedDomains": ["internal.company.com"],
        "maxRedirects": 3
      }
    }
  }
}

Attack Examples

AWS Metadata Access

GET /fetch?url=http://169.254.169.254/latest/meta-data/
Status: BLOCKED

GET /fetch?url=http://169.254.169.254/latest/meta-data/
Status: BLOCKED

Private IP Access

GET /proxy?url=http://192.168.1.1/admin
Status: BLOCKED

GET /proxy?url=http://192.168.1.1/admin
Status: BLOCKED

Localhost Access

GET /fetch?url=http://localhost:8080/internal-api
Status: BLOCKED

GET /fetch?url=http://localhost:8080/internal-api
Status: BLOCKED

DNS Rebinding

GET /proxy?url=http://attacker.com (resolves to 127.0.0.1)
Status: BLOCKED

GET /proxy?url=http://attacker.com (resolves to 127.0.0.1)
Status: BLOCKED

Configuration Parameters

Platform Compatibility

Related Protections

• Path Traversal
• Command Injection