Lab 2.4 - Protect against a SSRF attack

Task 1 - Implement Static Parameter values

  1. From Postman, click “Send” on the SSRF Attack-Dummy request. Notice you get content from Google via api.acme.com/vulnerable. This endpoint is vulnerable to Server Side Request Forgery attacks

image118

  1. From Postman, run SSRF Attack-unprotected-json. This site contains example ID and keys in JSON format. Hackers will uses your servers as a jump off point to gain access to internal resources

image119

  1. Navigate to Security -> Event Logs -> Application -> Requests and find both requests. Notice nothing appears malicious about these requests except for the destinations.

image120

  1. We are going to secure the the uri parameter, so it only allows access to Google, but not access to private data hosted internally.
  2. Navigate to Security -> Application Security -> Parameters -> Parameters List. Click the + Plus Symbol

image121

  1. Enter the Name uri
  2. Uncheck Perform Staging
  3. From the Parameter Value Type dropdown select Static Content Value
  4. Enter http://dummy.restapiexample.com/api/v1/employees for the New Static Value
  5. Click Add
  6. Click Create

image122

  1. Click Apply Policy
  2. From Postman, run SSRF Attack-Dummy. Access to Google is still allowed.
  3. From Post, run SSRF Attack-unprotected-json. This site is now blocked as intended

image123

  1. Navigate to Security -> Event Logs -> Application -> Requests and find the latest blocked request. The uri parameter is highlighted due to Illegal Static Parameter Value.

image124