HIGH ssrfbearer tokens
Ssrf with Bearer Tokens
Bearer Tokens-Specific Remediation
Remediating Bearer token SSRF vulnerabilities requires a defense-in-depth approach that addresses both the SSRF root cause and the token handling issues.
First, implement strict URL validation and allowlisting:
Related CWEs: ssrf
CWE ID Name Severity CWE-918 Server-Side Request Forgery (SSRF) CRITICAL CWE-441 Unintended Proxy or Intermediary (Confused Deputy) HIGH
Frequently Asked Questions
How can I test if my Bearer token API endpoint is vulnerable to SSRF?
Test with SSRF payloads like http://127.0.0.1:8080, http://169.254.169.254/latest/meta-data/, and http://internal-service.local. Use middleBrick's automated scanning which tests these patterns and checks if your endpoint makes requests to internal services using the Bearer token. The scanner also verifies if tokens are forwarded in outbound requests and if responses contain sensitive data.What's the difference between SSRF and traditional API attacks when Bearer tokens are involved?
Traditional API attacks target the API directly with stolen tokens, while SSRF exploits the server's ability to make outbound requests. With Bearer tokens, SSRF is particularly dangerous because it can bypass IP allowlisting, access internal services that aren't exposed to the internet, and use the token in contexts the attacker can't directly reach. SSRF can also expose tokens through error responses and metadata service access.