Webhook features let customers register a URL that a service will call. Because the URL is attacker-controlled and the request originates inside the service's network, every webhook feature is a server-side request forgery (SSRF) surface. This report describes a guard that closed a practical SSRF hole in a SaaS backend and the bypasses each layer of it prevents: a strict URL policy, a public-only resolver, redirect suppression with a connect-time DNS hook, and re-validation at send time. It also documents a second, independent fix, replacing per-attempt delivery errors with a single static message, because the failure text alone had formed a boolean oracle over the private network. Six defects in the first implementation are analysed, including lenient URL parsing and IPv6 transition addresses that embed IPv4. A reusable test set and an open-source Kotlin/JVM implementation, ssrf-guard, accompany the report. Companion software: ssrf-guard v0.1.0, 10.5281/zenodo.22697765. Article: andrii.korkoshko.com.
Andrii Korkoshko· Zenodo (CERN European Organi...· 0 citations
Webhook features let customers register a URL that a service will call. Because the URL is attacker-controlled and the request originates inside the service's network, every webhook feature is a server-side request forgery (SSRF) surface. This report describes a guard that closed a practical SSRF hole in a SaaS backend and the bypasses each layer of it prevents: a strict URL policy, a public-only resolver, redirect suppression with a connect-time DNS hook, and re-validation at send time. It also documents a second, independent fix, replacing per-attempt delivery errors with a single static message, because the failure text alone had formed a boolean oracle over the private network. Six defects in the first implementation are analysed, including lenient URL parsing and IPv6 transition addresses that embed IPv4. A reusable test set and an open-source Kotlin/JVM implementation, ssrf-guard, accompany the report. Companion software: ssrf-guard v0.1.0, 10.5281/zenodo.22697765. Article: andrii.korkoshko.com.
Andrii Korkoshko· Zenodo (CERN European Organi...· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
