Ssrf in Buffalo

Server-Side Request Forgery (SSRF) in Buffalo applications typically occurs when the framework accepts user-controlled URLs and makes outbound HTTP requests without proper validation. Buffalo's powerful github.com/gobuffalo/packr/v2 and asset handling capabilities can inadvertently create SSRF vulnerabilities when combined with dynamic URL generation.

A common Buffalo SSRF pattern emerges in actions that proxy external resources. For example:

func ImageProxy(c buffalo.Context) error {
    url := c.Param("url")
    resp, err := http.Get(url)
    if err != nil { return err }
    defer resp.Body.Close()
    
    c.Response().WriteHeader(resp.StatusCode)
    io.Copy(c.Response(), resp.Body)
    return nil
}

This action is vulnerable because it trusts the url parameter from the query string without validation. An attacker could request http://localhost:5432 to probe internal PostgreSQL instances, or http://169.254.169.254 to access AWS metadata services.

Buffalo's asset pipeline and webpack integration can also create SSRF scenarios. When using buffalo dev, the development server proxies requests to webpack-dev-server on port 3035. If user input influences which port or host is proxied, SSRF becomes possible:

func DevProxy(c buffalo.Context) error {
    target := c.Param("host") + ":" + c.Param("port")
    // Vulnerable: attacker controls target
    resp, err := http.Get("http://" + target)
    if err != nil { return err }
    defer resp.Body.Close()
    
    c.Response().WriteHeader(resp.StatusCode)
    io.Copy(c.Response(), resp.Body)
    return nil
}

The Buffalo POP (Plain Old Persistence) library can also be abused for SSRF when database connection strings are constructed from user input. While POP validates connection strings internally, improper handling of connection parameters can lead to SSRF through database proxy services or cloud metadata endpoints.

Detecting SSRF in Buffalo applications requires examining both the codebase and runtime behavior. middleBrick's black-box scanning approach is particularly effective for Buffalo apps because it tests the actual running API without needing source code access.

middleBrick scans Buffalo applications for SSRF by sending requests to endpoints that accept URL parameters and analyzing the responses. For a Buffalo app running on http://localhost:3000, middleBrick would test patterns like:

# Test for localhost SSRF
GET /api/proxy?url=http://localhost:3000/health

# Test for cloud metadata SSRF
GET /api/proxy?url=http://169.254.169.254/latest/meta-data/

# Test for internal network SSRF
GET /api/proxy?url=http://10.0.0.1

middleBrick's scanning engine identifies SSRF vulnerabilities by looking for telltale signs in the responses: successful HTTP status codes from internal services, timing differences that indicate network access, or error messages that reveal internal infrastructure details.

For Buffalo applications using OpenAPI specifications, middleBrick can cross-reference the spec definitions with runtime findings. If your actions/openapi.yaml defines a /proxy endpoint that accepts a url parameter, middleBrick will specifically target that endpoint with SSRF payloads and report whether it's properly secured.

Buffalo's development mode (buffalo dev) creates additional SSRF attack surfaces. middleBrick can detect if the development server is exposed to untrusted networks by attempting to access webpack-dev-server on port 3035 or the asset server on port 3001. These development-only services often have debugging endpoints that shouldn't be accessible in production.

Remediating SSRF in Buffalo applications requires a defense-in-depth approach. The most effective strategy combines input validation, allowlist filtering, and network segmentation.

First, implement strict URL validation using Go's net/url package:

func validateURL(rawURL string) (*url.URL, error) {
    parsed, err := url.Parse(rawURL)
    if err != nil {
        return nil, fmt.Errorf("invalid URL format")
    }
    
    // Block private IP ranges
    if isPrivateIP(parsed.Hostname()) {
        return nil, fmt.Errorf("private IP addresses not allowed")
    }
    
    // Block cloud metadata services
    if isMetadataService(parsed.Hostname()) {
        return nil, fmt.Errorf("metadata services not allowed")
    }
    
    return parsed, nil
}

func isPrivateIP(host string) bool {
    ip := net.ParseIP(host)
    if ip == nil {
        return false
    }
    return ip.IsPrivate() || ip.IsLoopback() || ip.IsLinkLocalUnicast()
}

func isMetadataService(host string) bool {
    metadataHosts := []string{
        "169.254.169.254",    // AWS
        "169.254.169.123",    // AWS time
        "metadata.google.internal", // GCP
        "169.254.169.254",    // Azure
    }
    return stringContains(metadataHosts, host)
}

func stringContains(arr []string, val string) bool {
    for _, s := range arr {
        if s == val {
            return true
        }
    }
    return false
}

Apply this validation in your Buffalo actions:

func SecureProxy(c buffalo.Context) error {
    rawURL := c.Param("url")
    parsedURL, err := validateURL(rawURL)
    if err != nil {
        return c.Error(http.StatusBadRequest, err)
    }
    
    // Additional allowlist check
    if !isAllowedHost(parsedURL.Hostname()) {
        return c.Error(http.StatusForbidden, fmt.Errorf("host not allowed"))
    }
    
    resp, err := http.Get(rawURL)
    if err != nil {
        return c.Error(http.StatusBadGateway, err)
    }
    defer resp.Body.Close()
    
    c.Response().WriteHeader(resp.StatusCode)
    io.Copy(c.Response(), resp.Body)
    return nil
}

func isAllowedHost(host string) bool {
    allowed := []string{
        "api.example.com",
        "cdn.example.net",
    }
    return stringContains(allowed, host)
}

For Buffalo applications using POP, ensure database connection strings are constructed server-side rather than accepting raw connection strings from users. Use POP's configuration validation to prevent SSRF through database proxies:

type DatabaseConfig struct {
    Host string `json:"host"`
    Port int `json:"port"`
    Name string `json:"name"`
}

func ConnectToDatabase(cfg DatabaseConfig) (*pop.Connection, error) {
    // Validate host is not a private IP or metadata service
    if err := validateURL(cfg.Host); err != nil {
        return nil, err
    }
    
    db, err := pop.NewConnection(&pop.ConnectionDetails{
        Host:     cfg.Host,
        Port:     cfg.Port,
        Database: cfg.Name,
    })
    if err != nil {
        return nil, err
    }
    
    return db, nil
}

Network segmentation provides the final layer of defense. Configure your Buffalo application's firewall to block outbound connections to private IP ranges and cloud metadata services at the network level, ensuring that even if validation fails, the application cannot reach internal systems.