Kibernetička sigurnost i ranjivosti: SSRF (Server-side Request Forgery)

master's thesis

• Title (english): Cyber security and vulnerabilities: SSRF (Server-side Request Forgery)
• Author: Lucija Valentić
• Mentor: Goran Igaly (mentor)
• Committee member: Goran Igaly (predsjednik povjerenstva)
• Committee member: Franka Miriam Brückler (član povjerenstva)
• Committee member: Ozren Perše (član povjerenstva)
• Committee member: Miljenko Marušić (član povjerenstva)
• Granter: University of Zagreb; Faculty of Science; (Department of Mathematics); Zagreb
• Defense date and country: 2022-09-27, Croatia
• Scientific / art field, discipline and subdiscipline: NATURAL SCIENCES; Mathematics

Abstract

SSRF je kibernetička ranjivost gdje zlonamjerni korisnik uspije “natjerati” ranjivu aplikaciju ili poslužitelj da napravi proizvoljan zahtjev prema nekoj proizvoljnoj lokaciji. Sama SSRF ranjivost ne mora biti opasna, ali njezinim iskorištavanjem se mogu potencijalno iskoristiti i neke druge ranjivosti koje jesu opasne. Iskorištavanjem SSRF ranjivosti se može doći do osjetljivih podataka, kontaktirati poslužitelje ili usluge unutar interne mreže koji nisu dostupni izvana, ili se nakon nje mogu iskoristiti i neke druge ranjivosti, te je moguće čak dobiti pristup poslužitelju i izvršavati kod iz daljine (RCE). Postoji više načina na koji se može aplikacija zaštititi od SSRF-a. Pažljivim programiranjem i korištenjem recimo kombinacije bijele liste i crne liste, te korištenjem vatrozida, može se smanjiti mogućnost da je aplikacija ranjiva na SSRF ranjivost. OWASP je 2021. godine uvrstio SSRF na svoj popis Top Ten Web Application Security Risks. Kao što i sam naziv govori, popis sadrži ranjivosti koje su bile najkritičnije te godine po mišljenjima stručnjaka.

Abstract (english)

SSRF is a cybersecurity vulnerability where malicous user forces an application or server to make a request to arbitrary location. SSRF vulnerability is not dangerous by itself, but chained with other vulnerabilites it can create very dangerous exploit-chain that can lead to exploatation of the application. Abusing SSRF vulnerability, an attacker can extract sensitive information (like passwords), contact servers or services that are not available from the outside, or, SSRF vulnerability can be used to perform other very dangerous attacks, such as Remote Code Execution (RCE). There are many ways to combat this vulnerability. Using good programming practices and maybe combining whitelist, blacklist and firewall, application can be made more safe from this kind of vulnerability at least. OWASP added SSRF vulnerability to their top ten list named Top Ten Web Application Security Risks. As it can be deducted from the name, the list consists of the most critical vulnerability that year based on consensus of experts.

• Keywords: ranjiva aplikacija; ranjivi poslužitelj; osjetljivi podaci; izvršavanje koda iz daljine (RCE); kombinacija bijele liste i crne liste; vatrozid; Top Ten Web Application Security Risks
• Keywords (english): vulnerable application; vulnerable server; sensitive information; passwords; Remote Code Execution (RCE); combining whitelist; blacklist; firewall; Top Ten Web Application Security Risks
• Language: croatian
• URN:NBN: urn:nbn:hr:217:821110
• Study programme: Title: Computer Science and Mathematics; Study programme type: university; Study level: graduate; Academic / professional title: magistar/magistra računarstva i matematike (magistar/magistra računarstva i matematike)
• Type of resource: Text
• File origin: Born digital
• Access conditions: Open access
• Created on: 2022-11-09 13:00:09