Server-Side Request Forgery

What Is Server-Side Request Forgery?

Server-side request forgery is the bug behind some of the largest cloud breaches on record, and the mistake is deceptively small: an application fetches a URL that a user supplied, and nobody checks where that URL points. In this exercise you start as Bob, an attacker who finds Corveil's link-preview feature, paste a link and the server builds a preview card for you. The catch is that Corveil's own servers do the fetching, so whatever URL you hand the feature, the server reaches it from inside its own network. You confirm that with a harmless probe, then aim the same request inward at the cloud metadata service, a fixed internal address every cloud instance exposes to hand out the credentials of the role attached to it. The preview worker dutifully fetches it and returns live instance credentials in the response. From there you sign a request with the borrowed credentials and list an internal store full of customer invoices, all through a feature meant to preview a link, with no login and no exploit code. Then the narrator switches: you are Alice, Corveil's application-security engineer, walking into a data-loss alert on the anomalous access. You open the preview handler, confirm it fetches any URL with no destination checks, and ship the fix, resolve the host and refuse private, loopback, and link-local ranges before making the request. You re-run the attacker's exact metadata probe against the patched endpoint and watch it come back blocked. The defense is not a string blocklist or a WAF rule. It is validating the resolved destination so the server can only ever reach public hosts, backed by token-required metadata and least-privilege roles as defense in depth. Mid-exercise checks lock in each mechanic in the moment, and a closing quiz tests whether you can recognize the pattern on sight.

What You'll Learn in Server-Side Request Forgery

• Explain server-side request forgery: an app fetching a user-supplied URL lets an attacker make the server reach systems the attacker cannot reach directly
• Recognize the cloud metadata service at 169.254.169.254 as a credential-issuing endpoint that an SSRF can reach even though an external attacker cannot
• Trace how a benign link-preview feature becomes a full credential-theft and data-exfiltration chain when the fetch destination is never validated
• Distinguish destination validation (resolve the host, deny private and link-local ranges, re-check after redirects) from fragile string blocklists, and explain why only the former holds
• Pair the code fix with defense in depth: token-required instance metadata (IMDSv2), least-privilege instance roles, and alerts on a fetch worker touching sensitive storage

Server-Side Request Forgery — Training Steps

1. The preview feature

   Corveil lets anyone paste a link and get back a tidy preview card, the page title and image, ready to drop into a message. The preview is not built in the browser: Corveil's own servers fetch the link. Bob opens the feature to see how it works before he touches it.

2. Where the request comes from

   One detail on that page is the whole reason Bob is interested.

3. Use the feature

   Watch the feature behave normally. Paste an ordinary news article and generate a preview, so the page makes a real request Bob can inspect.

4. Find the endpoint

   The request went out and the browser recorded it. Open the Network panel and read where the page actually sent it.

5. Aim it inward

   Bob rebuilds that request in the API Tester so he can point the url anywhere he likes. And the server will fetch whatever address he gives it, even ones he could never reach himself. Every cloud server has a metadata service at a fixed internal address that hands out the credentials of the role attached to that server. It is meant for the server's own use and it never checks who is asking. Bob just needs Corveil's preview worker to reach it for him.

6. Reach the metadata service

   Rebuild the preview request in the API Tester, but point the url at the metadata credentials path instead of a news article. Corveil's worker fetches it from inside the network and returns whatever it gets.

7. Credentials in hand

   The response is not a preview. It is a set of live credentials for the preview worker's cloud role.

8. Sign a request with the stolen key

   Corveil's internal storage trusts a signed request. Bob signs one with the AccessKeyId he just pulled from the metadata service and lists the bucket that holds customer invoices, a place no outside user can normally reach.

9. The data is gone

   Names, amounts, and invoice IDs, over forty thousand customer records, reached through a feature meant to preview a link.

10. Knowledge check

    You just watched a link-preview feature leak the server's credentials and then its data. Lock in why.