2021 OWASP Top Ten: Server Side Request Forgery

by F5 DevCentral
Video Thumbnail

📚 Main Topics

  • Introduction to SSRF
  • Mechanism of SSRF
  • Example Scenario
  • Mitigation Strategies
  • Importance of Awareness

✨ Key Takeaways

  • DefinitionServer Side Request Forgery (SSRF) is a security vulnerability that occurs when a web application fetches a remote resource without validating a user-supplied URL.
  • New AdditionSSRF is a new entry in the 2021 OWASP Top 10 list, highlighted as a significant risk based on community feedback.
  • Attack VectorAttackers can manipulate requests to access unintended endpoints, potentially bypassing firewalls and other security measures.

🏁 Example Scenario

  • In an online shopping application, a user checks if an item is in stock. The application sends a request to a backend API.
  • An attacker can modify the request to point to a sensitive internal URL (e.g., /admin), allowing them to access restricted information that should not be exposed.

📚 Mitigation Strategies

  1. Network SegmentationIsolate remote resource functionalities into separate networks to limit the impact of SSRF.
  2. Deny by Default PolicyImplement a firewall policy that denies all traffic by default, only allowing explicitly defined traffic.
  3. LoggingLog all accepted and blocked network flows to monitor and analyze potential SSRF attempts.

Network Layer

Application Layer

  1. Input ValidationSanitize and validate all client-supplied input data to prevent malicious URLs from being processed.
  2. Allow ListEnforce a positive allow list for URL schemes, ports, and destinations to restrict access to only trusted resources.

🧠 Lessons Learned

  • SSRF is increasingly relevant as applications become more complex and cloud-based services proliferate.
  • Awareness and proactive measures are essential to mitigate the risks associated with SSRF.
  • Continuous monitoring and logging are critical for identifying and responding to potential security threats.

By understanding SSRF and implementing the recommended strategies, organizations can better protect their applications from this emerging threat.

Keywords: f5 devcentral owasp top 10 explained with examples owasp top 10 server forgery ssrf server side request forgery attack security risk