119 lines
2.6 KiB
Python
119 lines
2.6 KiB
Python
"""
|
||
SSRF (服务端请求伪造) 漏洞知识
|
||
"""
|
||
|
||
from ..base import KnowledgeDocument, KnowledgeCategory
|
||
|
||
|
||
SSRF = KnowledgeDocument(
|
||
id="vuln_ssrf",
|
||
title="Server-Side Request Forgery (SSRF)",
|
||
category=KnowledgeCategory.VULNERABILITY,
|
||
tags=["ssrf", "request", "url", "network", "internal", "cloud"],
|
||
severity="high",
|
||
cwe_ids=["CWE-918"],
|
||
owasp_ids=["A10:2021"],
|
||
content="""
|
||
SSRF允许攻击者诱使服务器向内部资源或任意外部地址发起请求。
|
||
|
||
## 危险模式
|
||
|
||
### Python
|
||
```python
|
||
# 危险 - 直接使用用户URL
|
||
response = requests.get(user_provided_url)
|
||
urllib.request.urlopen(url_from_user)
|
||
httpx.get(user_url)
|
||
|
||
# 危险 - URL拼接
|
||
base_url = "http://internal-api/"
|
||
requests.get(base_url + user_path)
|
||
|
||
# 危险 - 图片/文件获取
|
||
image_url = request.args.get('url')
|
||
response = requests.get(image_url)
|
||
```
|
||
|
||
### Node.js
|
||
```javascript
|
||
// 危险
|
||
fetch(req.body.url);
|
||
axios.get(userUrl);
|
||
http.get(url, callback);
|
||
```
|
||
|
||
## 攻击目标
|
||
1. 内部服务 (localhost, 127.0.0.1, 内网IP)
|
||
2. 云元数据服务
|
||
- AWS: http://169.254.169.254/latest/meta-data/
|
||
- GCP: http://metadata.google.internal/
|
||
- Azure: http://169.254.169.254/metadata/
|
||
3. 内部API和数据库
|
||
4. 文件协议 (file://)
|
||
|
||
## 绕过技术
|
||
```
|
||
# IP绕过
|
||
http://127.0.0.1 -> http://127.1 -> http://0
|
||
http://localhost -> http://[::1]
|
||
http://2130706433 (十进制)
|
||
http://0x7f000001 (十六进制)
|
||
|
||
# DNS重绑定
|
||
attacker.com -> 解析到内网IP
|
||
|
||
# URL解析差异
|
||
http://evil.com@internal/
|
||
http://internal#@evil.com
|
||
```
|
||
|
||
## 检测要点
|
||
1. 所有发起HTTP请求的地方
|
||
2. URL参数是否来自用户
|
||
3. 是否有URL白名单验证
|
||
4. 是否限制了协议和端口
|
||
|
||
## 安全实践
|
||
1. URL白名单验证
|
||
2. 禁止访问内部IP地址
|
||
3. 使用DNS解析验证
|
||
4. 限制协议（仅http/https）
|
||
5. 禁用重定向或限制重定向
|
||
|
||
## 修复示例
|
||
```python
|
||
import ipaddress
|
||
from urllib.parse import urlparse
|
||
|
||
def is_safe_url(url):
|
||
try:
|
||
parsed = urlparse(url)
|
||
|
||
# 只允许http/https
|
||
if parsed.scheme not in ['http', 'https']:
|
||
return False
|
||
|
||
# 解析IP
|
||
import socket
|
||
ip = socket.gethostbyname(parsed.hostname)
|
||
ip_obj = ipaddress.ip_address(ip)
|
||
|
||
# 禁止私有IP
|
||
if ip_obj.is_private or ip_obj.is_loopback:
|
||
return False
|
||
|
||
# 白名单域名
|
||
if parsed.hostname not in ALLOWED_HOSTS:
|
||
return False
|
||
|
||
return True
|
||
except:
|
||
return False
|
||
|
||
# 使用
|
||
if is_safe_url(user_url):
|
||
response = requests.get(user_url, allow_redirects=False)
|
||
```
|
||
""",
|
||
)
|