Blind SSRF (Out-of-Band)

SSRF is the door from the internet into your internal network. Capital One's 2019 breach was an SSRF — the attacker pointed an EC2 instance's URL fetcher at the AWS instance metadata service at 169.254.169.254, pulled temporary IAM credentials, and walked off with 100 million credit applications. The bug is structural: applications that fetch user-supplied URLs are a regular feature of the modern web (image proxies, webhook deliveries, OG-image generators, RSS importers, ActivityPub federation, embed previews), and any one of them is a potential pivot from the public internet into the cloud's private control plane.

Blind SSRF appears when a server can be induced to make outbound requests on behalf of an attacker without returning the fetched content directly. The risk is internal network reachability and metadata exposure.

Cloud credential theft via instance metadata is the headline impact — temporary IAM creds plus a permissive role policy is full cloud account access. Internal admin panel access bypasses any network-perimeter authentication assumption ('only employees on the VPN can reach this'). Database connection pivots: the server's network position lets the SSRF talk to internal Postgres, Redis, Memcached, MongoDB. Lateral movement into the internal network turns one web bug into a cloud incident.

Validate URLs against an explicit allowlist of trusted hosts before any fetch. The allowlist is hostname-based and resolves DNS server-side. Block private IP ranges after resolution: RFC1918 (10/8, 172.16/12, 192.168/16), link-local (169.254/16, fe80::/10), loopback (127/8, ::1), unique-local IPv6 (fc00::/7), and the cloud metadata addresses specifically. Use a dedicated SSRF-safe HTTP client that resolves DNS once, fetches the resolved IP directly, and refuses to follow redirects to private space (defeats DNS rebinding). On AWS, switch to IMDSv2 — its session-token requirement breaks naive SSRF since the attacker can't forge the PUT request needed to obtain a token. Run the URL-fetching code in a network-segmented container with no route to private subnets, no metadata service access, and outbound DNS only via a controlled resolver. As a final layer, monitor for outbound requests from your fetcher hitting unusual hosts — large diff from baseline is signal.

SSRF is the bug class where 'allowlist hostnames, block private IPs, segment the fetcher' delivered consistently is more valuable than any single fix. Capital One's lesson cost $80M; the architectural fix is afternoon work.