6 ms·

These different representations also lead to frequent server side request forgery (SSRF) bypasses - someone might be blocking local IPv4 but you can still acces

These different representations also lead to frequent server side request forgery (SSRF) bypasses - someone might be blocking local IPv4 but you can still access their AWS metadata endpoint at ::ffff:169.254.169.254, etc. For anyone using Ruby, I'm the author of a gem [1] that comprehensively protects against SSRF bugs. For anyone using Golang I recommend this [2] blog post. [1]: https://github.com/arkadiyt/ssrf_filter https://github.com/arkadiyt/ssrf_filter [2]: https://www.agwa.name/blog/post/preventing_server_side_request_forgery_in_golang https://www.agwa.name/blog/post/preventing_server_side_reque...

proactivesvcs 6y ago
I wonder how many of these bugs are the result of people thinking "Well I've read the spec but most of it is 'cursed' so I'll just implement this subset which fits my idea of 'acceptable'".
- jitl 6y ago
  It’s more like “I firewalled everything using iptables, job done” but, there are no firewall rules in ip6tables. IPv6, what’s that? (My solution at home is to blanket block IPv6 entirely)
the_mitsuhiko 6y ago
Unfortunately the blacklisting approach that works on IPv4 is completely broken for IPv6 since you can't really know where your own services are. I still did not find a good generic way to protect IPv6 and ended up just disallowing it so far everywhere.
- arkadiyt 6y ago
  IPv6 has internal ranges defined just like IPv4 does - anything in an internal range should be blocked, and anything in an external range is safe to pass through.
  - the_mitsuhiko 6y ago
    Since there is no NAT in an IPv6 deployment unsafe services you typically want to prevent access to look like non internal ranges. Whereas in your normal IPv4 deployment you might have your protected service on 192.168.4.111 with IPv6 it will just share the same prefix (potentially) as your host.
    - Dylan16807 6y ago
      Isn't this what the fd/8 local addresses are for?
    - icedchai 6y ago
      NAT was meant to work around IP exhaustion issues, not act as a security layer. By accident, it often happens to provide some additional security. By keep in mind those "internal" IP addresses may be routable in some cases, due to either accidental or deliberate mis-configuration. IPv6, with end-to-end connectivity, is how the Internet is supposed to work. It's how it did work in the early 90's, even with IPv4. If you want to secure your servers, use a firewall. Maybe it's a host-based firewall.
      - cle 6y ago
        What are the practical reasons we should rearchitect our systems to remove NAT? (I know the weaknesses of NAT but the cat’s out of the bag at this point...the question isn’t really “why should we use NAT”, it’s “why should we go through the pain of breaking it”.)
        lmm 6y ago
        IPv6 does nothing to break NAT, you could deploy the exact same kind of NAT and it would have the exact same behaviour, if you really want to make your router use a bunch more memory/CPU and make it a pain for users to do anything that needs a direct connection. But you gain nothing from doing that.
      - octoberfranklin 6y ago
philsnow 6y ago
This is awesome; do you know if anybody has written a rails plugin to use ssrffilter by default for all requests?
- arkadiyt 6y ago
  Rails doesn't provide any standard mechanism/library for sending http requests, so I don't think there's anything in Rails to apply the gem to
jamespwilliams 6y ago
> ::ffff:169:254:169:254 Just to note, this should be ::ffff:169.254.169.254
stevekemp 6y ago
For golang I wrote this: https://github.com/skx/remotehttp https://github.com/skx/remotehttp I've found, and reported, a whole bunch of services which take user-supplied URLs and don't filter out access to localhost:8080/server-status, and similar local resources. A common route to attacking these is to access the AWS metadata URL endpoint. Something at least the Google cloud prevents, by forcing the use of the `Metadata-Flavor: Google` header.

proactivesvcs 6y ago

I wonder how many of these bugs are the result of people thinking "Well I've read the spec but most of it is 'cursed' so I'll just implement this subset which fits my idea of 'acceptable'".

jitl 6y ago
It’s more like “I firewalled everything using iptables, job done” but, there are no firewall rules in ip6tables. IPv6, what’s that? (My solution at home is to blanket block IPv6 entirely)

the_mitsuhiko 6y ago

Unfortunately the blacklisting approach that works on IPv4 is completely broken for IPv6 since you can't really know where your own services are. I still did not find a good generic way to protect IPv6 and ended up just disallowing it so far everywhere.

arkadiyt 6y ago
IPv6 has internal ranges defined just like IPv4 does - anything in an internal range should be blocked, and anything in an external range is safe to pass through.
- the_mitsuhiko 6y ago
  Since there is no NAT in an IPv6 deployment unsafe services you typically want to prevent access to look like non internal ranges. Whereas in your normal IPv4 deployment you might have your protected service on 192.168.4.111 with IPv6 it will just share the same prefix (potentially) as your host.
  - Dylan16807 6y ago
    Isn't this what the fd/8 local addresses are for?
  - icedchai 6y ago
    NAT was meant to work around IP exhaustion issues, not act as a security layer. By accident, it often happens to provide some additional security. By keep in mind those "internal" IP addresses may be routable in some cases, due to either accidental or deliberate mis-configuration. IPv6, with end-to-end connectivity, is how the Internet is supposed to work. It's how it did work in the early 90's, even with IPv4. If you want to secure your servers, use a firewall. Maybe it's a host-based firewall.
    - cle 6y ago
      What are the practical reasons we should rearchitect our systems to remove NAT? (I know the weaknesses of NAT but the cat’s out of the bag at this point...the question isn’t really “why should we use NAT”, it’s “why should we go through the pain of breaking it”.)
      - lmm 6y ago
        IPv6 does nothing to break NAT, you could deploy the exact same kind of NAT and it would have the exact same behaviour, if you really want to make your router use a bunch more memory/CPU and make it a pain for users to do anything that needs a direct connection. But you gain nothing from doing that.
    - octoberfranklin 6y ago

philsnow 6y ago

This is awesome; do you know if anybody has written a rails plugin to use ssrffilter by default for all requests?

arkadiyt 6y ago
Rails doesn't provide any standard mechanism/library for sending http requests, so I don't think there's anything in Rails to apply the gem to

jamespwilliams 6y ago

> ::ffff:169:254:169:254 Just to note, this should be ::ffff:169.254.169.254

stevekemp 6y ago

For golang I wrote this: https://github.com/skx/remotehttp https://github.com/skx/remotehttp I've found, and reported, a whole bunch of services which take user-supplied URLs and don't filter out access to localhost:8080/server-status, and similar local resources. A common route to attacking these is to access the AWS metadata URL endpoint. Something at least the Google cloud prevents, by forcing the use of the `Metadata-Flavor: Google` header.