Ssrf Blind in Adonisjs

Server-Side Request Forgery (SSRF) Blind attacks are a subset of SSRF where the attacker cannot directly observe the response from an internal request but can infer behavior through indirect indicators such as timing, error messages, or secondary system states.

In AdonisJS, SSRF Blind often manifests when an application makes HTTP calls to external or internal resources based on user-supplied input without proper validation or restriction. For example, an endpoint that allows a user to provide a URL to fetch a remote image for processing may be vulnerable if it uses a library like HttpNode or axios without network egress controls.

// Vulnerable route in AdonisJS controller

@Http.post('/fetch-image')
async fetchImage({ request }) {
  const { url } = request.body()
  const response = await Http.get(url)
  return response.body()
}

An attacker could submit http://internal.admin/api/health as the URL. If the server responds differently based on the target (e.g., different status codes, response body length, or delay), the attacker can gradually map internal services through blind probing.

Common AdonisJS code patterns that lead to SSRF Blind include:

• Using Http.get(), Http.post(), or fetch() with untrusted input
• Parsing URLs from request parameters or headers without validation
• Allowing file uploads that trigger external processing via APIs
• Using third-party packages like sharp or puppeteer to fetch remote assets

These patterns are especially risky when deployed behind cloud-native environments where outbound network access is not restricted by default.

Detection of SSRF Blind in AdonisJS applications requires understanding both the runtime behavior and the framework's request handling lifecycle.

middleBrick identifies SSRF Blind by analyzing unauthenticated interactions with endpoints that accept URL parameters and perform outbound HTTP requests. The scanner checks for:

• Endpoints that accept a url parameter without validation
• Use of HttpNode, axios, or fetch() in route handlers
• Discrepancies in response timing or status codes when targeting internal IP ranges (e.g., 127.0.0.1, 10.0.0.0/8)
• Error messages that leak internal topology

When scanning an AdonisJS endpoint like POST /fetch-image, middleBrick sends requests to internal metadata services (e.g., http://169.254.169.254) and observes behavioral changes. Even without direct response visibility, it detects blind indicators such as increased latency, shift in HTTP status from 200 to 500, or changes in response size.

middleBrick's OWASP API Top 10 alignment ensures SSRF Blind findings are mapped to API Top 10 Category A5 (2023), which covers broken object level authorization and excessive data exposure that often accompany SSRF vulnerabilities.

Remediation of SSRF Blind in AdonisJS should focus on input validation, network egress control, and use of framework-native security patterns.

Recommended fixes include:

// Secure approach using URL validation and allowlist

@Validated.route('fetch-image')
async fetchImage({ request }) {
  const schema = schema({
    url: 
      rules.string().url({
        allowOnly: ['http:', 'https:']
      }).ruleset()
  })

  const { url } = await superValidator.validate(schema)

  // Optional: Add domain allowlist
  const allowedHosts = ['images.trusted-cdn.com']
  const parsedUrl = new URL(url)
  if (!allowedHosts.includes(parsedUrl.hostname)) {
    throw new Error('Blocked external URL')
  }

  const response = await Http.get(url, { responseType: 'stream' })
  return response.body
}

Additionally, AdonisJS applications should restrict outbound network access using infrastructure controls (e.g., firewall rules, cloud security groups) to prevent access to internal IP ranges.

Use of AdonisJS's built-in validation and schema tools helps enforce strict input policies. For example, rejecting private IP addresses and limiting protocols to HTTPS unless explicitly required.

Another mitigation is to avoid making outbound requests directly from controllers. Instead, route such logic through a dedicated service with strict access controls:

// Service layer with validation

class ImageService {
  static async fetch(url) {
    const allowedHosts = ['images.example.com']
    const parsedUrl = new URL(url)
    if (!allowedHosts.includes(parsedUrl.hostname)) {
      throw new Error('Unauthorized host')
    }
    return Http.get(url)
  }
}

By combining application-level validation with infrastructure-level egress restrictions, developers can significantly reduce SSRF Blind risk in AdonisJS applications.