SSRF, file upload and path traversal

Some of the most serious web bugs happen when the server fetches, stores or reads something on the attacker's behalf. The application becomes a confused deputy.

Server-side request forgery

SSRF tricks the server into making a request to a destination the attacker chooses. Because the request originates inside the network, it may reach internal services that are not exposed to the internet.

Common targets:

• cloud metadata endpoints;
• internal admin panels;
• databases and caches;
• other services that trust the application's network position.

Defences:

• allow-list approved destinations;
• block link-local, loopback and metadata ranges at the network layer;
• do not follow redirects blindly;
• require authentication on internal services;
• log outbound requests from application servers.

Path traversal

../../etc/passwd escapes an intended directory. The fix is to canonicalise the path and verify it stays inside the allowed root, ideally by using an identifier rather than a user-supplied path.