PHTalks Bengaluru - SSRF When All Else Fails

What happens when all public ways to achieve an impactful SSRF fail?
Watch us dive deep into internal hostnames and achieve a novel SSRF!

Transcript

1. SSRF. When All Else Fails. Positive Hack Talks
2. Who are We? ▪ Hacker, Bug Bounty Hunter ▪ Top 200 on Bugcrowd ▪ 30+ P1s and 3x MVP - Bugcrowd ▪ Dell, Netflix, Lululemon, Expressvpn and … ▪ @ThisIsDK999 on Twitter ▪ Security Researcher ▪ Web3 Fanatic ▪ Level0x3 on Synack Red Team ▪ Fortune 100 Companies you’ve surely heard about ▪ CVE 2023 - 41875, CVE 2023 - 40607 ▪ @RathiArpeet on Twitter Debangshu Kundu Arpeet Rathi
3. tl;dr 01 Primer to SSRF An introduction to Server Side Request Forgery 02 Common Ways to SSRF 03 SSRF When All Else Fails Novel Research on a never known before SSRF scenario Publicly available ways to find and escalate SSRF
4. 01. SSRF PRIMER A basic primer on SSRF and how it translates to real - life scenarios.
5. What is SSRF? OWASP Says… In a Server - Side Request Forgery (SSRF) attack, the attacker can abuse functionality on the server to read or update internal resources. The attacker can supply or modify a URL which the code running on the server will read or submit data to, and by carefully selecting the URLs, the attacker may be able to read server configuration such as AWS metadata, connect to internal services like http enabled databases or perform post requests towards internal services which are not intended to be exposed.
6. How Bad Is it? PRETTY BAD…
7. 140, 000 SOCIAL SECURITY NUMBERS
8. 80 , 000 BANK ACCOUNT NUMBERS
9. …And 100 Million Users Affected
10. NORMAL R EQUEST ?ur l=http://internal FIREWALL Explain to me like I’m 5… EVIL R EQUEST Heckerman WEBAPP INTERNAL INFRA
11. 02. Common Ways to SSRF What do we already know about finding and exploiting SSRFs?
12. Common entrypoints… • Passing an internal URL to url=, uri= params that normally fetch a remote resource • Webhooks! • File Import/Upload Functionality • Awesome PDF Generators • Outdated Enterprise Software CVEs ( e.g : Jira, Jenkins) • Leaking AWS Creds via XXE • Host Header Injection • SSRF via Referer header (mostly blind) • Leveraging Open Redirects
13. And how do you escalate? • Hit Cloud Metadata (169.254.169.254) • Hit subdomains pointing to an external IP, residing on a gated infrastructure ( e.g : VPN - only assets) • Port scan to enumerate vulnerable services • Internal admin infrastructure running on localhost • Leverage Open Redirects to bypass filters (Whitelisted hosts) • Use DNS Rebinding • Observe Response - Time delays to enumerate open ports
14. 03. SSRF, when all else fails Novel research on a never - known - before SSRF scenario
15. Common entrypoints… • Passing an internal URL to resource • Webhooks! url=, uri= params that normally fetch a remote Remember Them?
16. WEBHOOKS… (as an SSRF vector)
17. What are Webhooks? Webhooks are user - defined HTTP Callbacks. They are event snippets that fire upon the completion of a said action. - triggered code Whenever that trigger event occurs in the source site, the webhook sees the event, collects the data, and sends it to the URL specified by you in the form of an HTTP request. You can even configure an event in one site to trigger an action in another site.
18. Explain to me like i’m 5
19. SSRF VIA WEBHOOKS... (Tricking normal webhooks to perform abnormal stuff)
20. ‘Nuff said, let’s talk business POST / webhoooks /123/data Event triggered POST Request Event data APPLICATION randomxyz.burpcollaborator.net HTTP WEBHOOK Collaborator Instance
21. SSRF confirmed, what’s next?
22. Very obvious? Yes, Metadata! POST / webhoooks /123/data Event triggered POST Request Event data APPLICATION http://metadata.google.internal HTTP WEBHOOK GCP Metadata
23. Uh oh, Back to the drawing board… METHOD NOT ALLOWED
24. Redirect To The Rescue (303) 303 Redirect WEBHOOK POST Request GET Request HTTP HTTP EVIL SERVER GCP METADATA
25. Problems…Problems.. “Metadata - flavor : Google” header requirement
26. Why is this? In short, header requirement enforced to prevent SSRFs This header indicates that the request was sent with the intention of retrieving metadata values, rather than unintentionally from an insecure source, and lets the metadata server return the data you requested. If you don't provide this header, the metadata server denies your request.
27. So… any workarounds? GCP allowed v1beta1 endpoint to extract GCP token without header requirement However, this was deprecated in 2020. Need to be lucky!
28. GCP BETA Endpoints? GCP /v1beta1/ endpoints are forbidden
29. What now? • Can we hit localhost? • Yes! However, no vulnerable services listening on internal ports were found. (java.net.ConnnectException )
30. SSRF GLOSSARY? (known ways to escalate) • • • • • • • • • • • • Redis? Gopher? git:// protocol? jar:// protocol? dict:// protocol? ldap:// protocol? netdoc:// protocol? FTP Protocols? Using SURF by Assetnote to find SSRF candidates? Tomcat? Port Scanning on Localhost? CRLF Injection to inject “`Metadata - Flavor : Google” header? • DNS Rebinding • Docker API?
31. Our failures… (failed ways to escalate) • • • • • • • • Redis? Gopher? Not supported git:// protocol? Using SURF by Assetnote to find SSRF candidates? Tomcat? Port Scanning on Localhost? NTLM Relay Attack to steal NTLM v1/v2 hashes (since JAVA backend) Abusing application functionality to add “`Metadata - Flavor : Google” header? • CRLF Injection to inject “`Metadata - Flavor : Google” header? • Kubernetes API @ https://kubernetes.default.svc ? • Trying every possible scenario from “ PayloadsAllTheThings ” repo
32. SSRF when all else fails… (our approach when all public SSRF resources failed) The entrypoint :- Fuzzing for possible SSRF candidates revealed an interesting error that helped us fingerprint the tech behind it, leading us to this -
33. SSRF when all else fails… (our approach when all public SSRF resources failed) • LINKERD PROXY
34. SSRF when all else fails… (our approach when all public SSRF resources failed) What is LINKERD?
35. SSRF when all else fails… Okay…what next? Linkerd exposes Bundled Prometheus Instance at “ prometheus.linkerd - viz.svc.cluster.local ”
36. SSRF when all else fails… <?php header('Location: http://prometheus.linkerd viz.svc.cluster.local:9090/api/v1/targets/metadata', TRUE, 303); ?> 303 Redirect POST Request - viz.svc.cluster.local GET Request HTTP WEBHOOK http://prometheus.linkerd HTTP EVIL SERVER LINKERD PROMETHEUS INSTANCE
37. VOILAA!! Full access to Internal Prometheus Instance!
38. VOILAA!! Complete access to Internal Grafana Instance! grafana.linkerd - viz.svc.cluster.local:3000
39. Let’s Dump all • /api /v1/query?query =request_total P rometheus queries!
40. Let’s Dump all • P rometheus queries! /api /v1/targets/metadata prometheus.linkerd - viz.svc.cluster.local:9090/ api /v1/targets/metadata
41. Let’s Dump all • /api /v1/series?match P rometheus queries! []= up&match []= process_start_time_seconds {job=%22prometheus%22}} (returns all series that match the selectors) prometheus.linkerd - viz.svc.cluster.local:9090/ api /v1/series
42. Let’s Dump all • P rometheus queries! Service Discovery Dashboard prometheus.linkerd - viz.svc.cluster.local:9090/service - discovery
43. But wait…there’s more! Ability to cause an abrupt shutdown via a single POST request to http://localhost:4191
44. So.. That’s how you… SSRF when all else fails!
45. Takeaways :• There’s always something new waiting to be discovered • The nature of vulns like SSRF is not to be taken lightly • With Full Response SSRFs, it’s just a matter of discovery. So, don’t give up! • Fuzzing input fields with malformed inputs may give out infrastructure information.
46. Dox Us! dk999appsec@gmail.com Twitter: @ThisIsDK999 Debangshu Kundu r.arpeet82@gmail.com Twitter: @RathiArpeet Arpeet Rathi
47. Thank you! Happy Hacking!