CornCon_11 FRI-T2-9:00 David Garlak & Jon Schnell Chasing SSRF in Downstream Asynchronous Workflows
Analysts investigate attack surfaces and defenses concerning CornCon_11 FRI-T2-9:00 David Garlak & Jon Schnell Chasing SSRF in Downstream Asynchronous Workflows.
Summary
SSRF Basics
David Garlak and Jon Schnell of Rapid7 define server-side request forgery as an injection point where the server fetches attacker-chosen URLs—acting as a proxy to internal or external resources. Variants include open redirects, file/SMB schemes, weak credentials, and cloud metadata misconfigurations.
Transparency Levels
They categorize transparent SSRF (attacker sees full response), semi-blind (DNS or partial hits only), and blind SSRF (no outbound visibility, requiring side channels). These labels frame later discussion of asynchronous workflows.
Defense Layers
Mitigations start with strict URL allowlisting—not denylisting—and careful URI parsing quirks. Response validation matters: teams often validate inbound input but trust fetched content. Network isolation and tight egress filtering reduce semi-blind callbacks.
Async Workflow Angle
The core topic is SSRF in downstream asynchronous jobs—webhooks, profile image fetchers, and background tasks where the request and response are decoupled. Attackers abuse delayed or blind fetches where traditional synchronous SSRF testing fails, demanding correlation across job queues and egress logs.
Related talks
CornCon 11·41 min
CornCon_11 FRI-T2-9:45 - Randy Rose -Mental Malware/Inside the Supervillain's Psychological Playbook
Security researchers examine technical aspects of CornCon_11 FRI-T2-9:45 - Randy Rose -Mental Malware/Inside the Supervillain's Psychological Playbook.
BITM Hacklab·33 min
David Calligaris
Industry experts analyze emerging threats surrounding No Hat 2021 - David Calligaris - The Infinite Game of Vulnerability Research.
Black Hat·33 min
Presenters detail vulnerability discovery and exploitation in API-Induced SSRF: How Apple Pay Scattered Vulnerabilities Across the Web.