HackBlue

Labs / Web and API security

SSRF allowlist evaluator

An image import feature fetches URLs on the server. Combine host matching, address checks, redirect checks, and pinning until nine test URLs behave.

  • Interactive lab
  • Advanced
  • 5 steps
  • 0 of 5 solved

Goal

A catalog tool lets suppliers paste an image URL, and the server downloads it. The server sits in a cloud network next to an admin service and the instance metadata endpoint.

Nine URLs from the test plan are listed below. Choose the host check and turn on the controls you need until both partner images load and nothing reaches an internal address or an unlisted host. DNS and redirects are simulated.

Host check

Controls

Allowlist

  • images.partner.example
  • cdn.partner.example
  • media.partner.example
  • legacy.partner.example
Test plan5 wrong
  • fetched
    https://images.partner.example/catalog/42.pngAn ordinary product image · should load
  • fetched
    https://cdn.partner.example/i/7Partner CDN link that redirects to the image host · should load
  • reached unlisted host
    https://images.partner.example.attacker.example/x.pngThe allowed name followed by another domain · should be blocked
  • reached unlisted host
    https://images.partner.example@203.0.113.9/x.pngThe allowed name before an @ sign · should be blocked
  • blocked
    http://169.254.169.254/latest/meta-data/The cloud instance metadata address · should be blocked
  • blocked
    http://0x7f000001:8080/Loopback written in hexadecimal · should be blocked
  • reached internal
    https://cdn.partner.example/r/old-logoAn allowed host that redirects inside the network · should be blocked
  • reached internal
    https://legacy.partner.example/logo.pngAn allowed name whose DNS points at a private address · should be blocked
  • reached internal
    https://media.partner.example/a.pngA name whose DNS answer changes between check and connect · must not reach inside

Steps

  1. 01Configure the fetcher so both partner images load and no request reaches an internal address or a host that is not on the list.

    Do this in the workbench above. This step completes itself when the condition is met.

  2. 02For https://images.partner.example@203.0.113.9/x.png, which host does the URL parser say the request goes to?

  3. 03legacy.partner.example is on the allowlist. Why does the fetcher still need to check the resolved address?

  4. 04media.partner.example passes the private-address check and still reaches 127.0.0.1 unless one control is on. Which one?

  5. 05Which extra layer limits the damage if a check is ever missed?