Ssrf Cloud Metadata in Buffalo

In Buffalo applications, SSRF vulnerabilities often arise when user-controlled input is used to construct outbound HTTP requests without proper validation. A common pattern involves proxy endpoints or webhook handlers that forward requests to internal services. For example, a Buffalo handler might accept a url query parameter and use net/http to fetch it, inadvertently allowing access to cloud metadata services like AWS EC2's 169.254.169.254 or GCP's metadata.google.internal. Attackers can exploit this to retrieve sensitive instance metadata, including IAM role credentials, which may lead to privilege escalation or lateral movement within the cloud environment.

Specific to Buffalo, this frequently occurs in handlers generated by buffalo generate resource or custom middleware where c.Request().URL.Query().Get("url") is passed directly to http.Get() without sanitization. For instance, a handler designed to proxy image URLs might look like:

func ImagesProxy(c buffalo.Context) error {
    targetURL := c.Request().URL.Query().Get("url")
    if targetURL == "" {
        return c.Error(400, errors.New("missing url parameter"))
    }
    resp, err := http.Get(targetURL) // SSRF if targetURL is controlled
    if err != nil {
        return c.Error(502, err)
    }
    defer resp.Body.Close()
    c.Set("Content-Type", resp.Header.Get("Content-Type"))
    return c.Stream(resp.StatusCode, resp.Body)
}

An attacker could supply http://169.254.169.254/latest/meta-data/iam/security-credentials/ to obtain temporary AWS credentials. This is particularly dangerous in environments where the Buffalo app runs with excessive IAM permissions, as seen in real-world incidents like CVE-2020-13942 (SSRF in Apache Druid leading to metadata exposure).

Detecting SSRF to cloud metadata in Buffalo applications requires identifying endpoints that make outbound HTTP requests based on user input. middleBrick automates this by scanning for parameters like url, link, callback, or destination that are subsequently used in net/http calls. During a scan, middleBrick sends payloads targeting known cloud metadata endpoints (e.g., AWS, Azure, GCP) and analyzes responses for signatures such as ami-id, instance-id, or project-id in the returned data.

For a Buffalo app, you can initiate a scan via the CLI:

middlebrick scan https://your-buffalo-app.example.com

This will test all discoverable endpoints, including those defined in actions/* folders. If a handler like ImagesProxy exists, middleBrick will probe it with SSRF payloads and check for metadata leakage. The resulting report will flag the issue under the "SSRF" category with severity based on exposure (e.g., if credentials are returned, severity is "critical").

Additionally, middleBrick checks for missing mitigations such as allowlists, blocklists of private IP ranges (RFC 1918, 169.254.0.0/16), or metadata service headers. It cross-references findings with the OpenAPI spec if available, ensuring that even undocumented or legacy endpoints are tested.

To remediate SSRF vulnerabilities in Buffalo applications, implement strict input validation and outbound request controls using Buffalo's native patterns and Go's standard library. The most effective defense is to avoid passing user input directly to HTTP clients. Instead, use an allowlist of approved domains or paths. For example, if the proxy should only fetch images from a trusted CDN:

func ImagesProxy(c buffalo.Context) error {
    targetURL := c.Request().URL.Query().Get("url")
    if targetURL == "" {
        return c.Error(400, errors.New("missing url parameter"))
    }
    u, err := url.Parse(targetURL)
    if err != nil {
        return c.Error(400, err)
    }
    // Allowlist: only permit specific hosts
    allowed := map[string]bool{
        "cdn.example.com": true,
        "assets.example.com": true,
    }
    if !allowed[u.Host] {
        return c.Error(403, errors.New("host not allowed"))
    }
    // Optional: enforce scheme and path
    if u.Scheme != "https" {
        return c.Error(400, errors.New("only HTTPS allowed"))
    }
    resp, err := http.Get(u.String())
    if err != nil {
        return c.Error(502, err)
    }
    defer resp.Body.Close()
    c.Set("Content-Type", resp.Header.Get("Content-Type"))
    return c.Stream(resp.StatusCode, resp.Body)
}

Alternatively, use a blocklist to reject known dangerous ranges, though this is less secure than an allowlist due to potential bypasses (e.g., DNS rebinding, cloud provider-specific IPs). For metadata service protection, block 169.254.0.0/16 and fd00:ec2::/32 (IPv6):

func isBlocked(host string) bool {
    ip := net.ParseIP(host)
    if ip == nil {
        // hostname; resolve first (caution: TOCTOU)
        addrs, err := net.LookupIP(host)
        if err != nil {
            return true // treat unresolved as blocked
        }
        for _, addr := range addrs {
            if isBlocked(addr.String()) {
                return true
            }
        }
        return false
    }
    // Check IPv4 private and link-local
    if ip4 := ip.To4(); ip4 != nil {
        switch {
        case ip4[0] == 10:
            return true
        case ip4[0] == 172 && ip4[1] >= 16 && ip4[1] <= 31:
            return true
        case ip4[0] == 192 && ip4[1] == 168:
            return true
        case ip4[0] == 169 && ip4[1] == 254:
            return true // EC2 metadata
        }
    }
    // Check IPv6 ULA and link-local
    if ip16 := ip.To16(); ip16 != nil {
        switch {
        case ip16[0] == 0xfd || ip16[0] == 0xfc:
            return true // ULA
        case ip16[0] == 0xfe && ip16[1]&0xc0 == 0x80:
            return true // link-local
        case ip16[0] == 0xfd && ip16[1] == 0x00 && ip16[2] == 0xec && ip16[3] == 0x02:
            return true // fd00:ec2::/32 (AWSv2)
        }
    }
    return false
}

Then integrate this check before making the outbound request. middleBrick validates these fixes by rescanning and confirming that SSRF payloads no longer return metadata. Always pair this with logging and monitoring for anomalous outbound connections.