Examkin

Question

Difficulty: MediumApplication and Software Vulnerabilities

During a security audit of a cloud-hosted web application, an analyst reviews HTTP traffic for a feature that imports custom user avatars from external URLs. The logs show an HTTP request to the endpoint `/api/v1/fetch-avatar?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/`. The application returned secret access keys for the underlying cloud server instance to an unauthenticated remote user. Which of the following vulnerabilities was exploited, and what is the primary developer-side remediation?

  1. Server-Side Request Forgery (SSRF); restrict the application server from making unauthorized outbound network requests to internal resource addresses and validate incoming target URLs against an allowlist.Answer
  2. B
    Cross-Site Scripting (XSS); implement contextual HTTP output encoding and Content Security Policy (CSP) headers to sanitize scripts rendered in client browsers.
  3. C
    Insecure Direct Object Reference (IDOR); implement object-level authorization checks in database queries to ensure users can only access their own assigned avatar object IDs.
  4. D
    Buffer Overflow; configure host-based network firewalls (HFW) to drop incoming HTTP request packets exceeding the allocated buffer length.

Answer

Server-Side Request Forgery (SSRF); restrict the application server from making unauthorized outbound network requests to internal resource addresses and validate incoming target URLs against an allowlist.
The scenario describes Server-Side Request Forgery (SSRF). In SSRF attacks, a vulnerable application accepts a user-supplied URL and makes a backend HTTP request to that URL without adequate input validation or network segregation. Because the request originates from the application server itself, it bypasses network boundary protections and accesses internal services—such as the cloud Instance Metadata Service (`169.254.169.254`). Primary mitigations include validating incoming URLs against strict domain/IP allowlists and restricting server egress traffic to block calls to internal IP blocks and metadata addresses.

Step-by-Step Solution

1
Analyze the request payload in the audit logs
The URL parameter points to `169.254.169.254`, which is the non-routable IPv4 link-local address reserved for Cloud Instance Metadata Services (IMDS).
Identifying the target IP address clarifies whether the request targets external public resources or internal cloud infrastructure endpoints.
2
Identify the core application vulnerability
The web application processes user-supplied URLs and issues HTTP requests from the backend server to internal resources without restricting destination domains or IP ranges, characteristic of Server-Side Request Forgery (SSRF).
SSRF occurs when a backend server acts as a proxy for an attacker, sending HTTP requests on their behalf to internal network locations.
3
Determine the effective remediation control
Validate and filter user-supplied input against strict URL allowlists, and enforce network-level network egress rules/firewalls preventing web application servers from communicating with metadata addresses (169.254.169.254) or local loopback interfaces.
Restricting backend outbound routing combined with input URL filtering effectively blocks SSRF vectors.

Key Concept

Server-Side Request Forgery (SSRF) and Cloud Metadata Protection
Rate this question

Topics

Application and Software Vulnerabilities

More questions from this topic