Overview
SSRF vulnerabilities can allow an attacker to coerce a server into making requests to internal resources, cloud metadata endpoints, or other services the attacker should not reach. In cloud environments this can lead to exposure of sensitive data, access to private networks, or even lateral movement if internal services are misconfigured. For Echo-based Go apps, SSRF typically arises when a handler accepts a URL from user input and directly uses it to perform an outbound request, effectively turning your server into a proxy. Real-world impact includes exposure of internal services, metadata endpoints, and potential abuse of internal admin interfaces through crafted requests.
In Echo, this vulnerability manifests when a route reads a URL from a query parameter or request body and uses net/http to fetch that URL without proper validation. The issue is not inherent to Echo itself, but to how inbound user-controlled values drive outbound requests. Attackers may exploit redirects, proxy chains, or mixed protocol flows if redirects are not restricted, leading to data leakage or access to restricted resources via your service.
Remediation focuses on tightening outbound fetch logic: validate and canonicalize inputs, enforce an allowlist of permitted destinations, and use a hardened HTTP client with timeouts and size limits. Avoid relaying raw remote content back to clients; instead, constrain responses and log attempts for monitoring and incident response.
Code Fix Example
Echo API Security Remediation
package main
import (
"io"
"io/ioutil"
"net/http"
"net/url"
"time"
"github.com/labstack/echo/v4"
)
func vulnerableHandler(c echo.Context) error {
target := c.QueryParam("url")
if target == "" {
return c.String(http.StatusBadRequest, "missing url")
}
resp, err := http.Get(target)
if err != nil {
return c.String(http.StatusBadGateway, "error fetching url")
}
defer resp.Body.Close()
body, _ := ioutil.ReadAll(resp.Body)
return c.String(resp.StatusCode, string(body))
}
func isAllowed(u *url.URL) bool {
allowed := map[string]bool{"example.com": true, "api.example.com": true}
host := u.Hostname()
return allowed[host]
}
func safeHandler(c echo.Context) error {
target := c.QueryParam("url")
if target == "" {
return c.String(http.StatusBadRequest, "missing url")
}
u, err := url.Parse(target)
if err != nil {
return c.String(http.StatusBadRequest, "invalid url")
}
if !isAllowed(u) {
return c.String(http.StatusForbidden, "host not allowed")
}
client := &http.Client{
Timeout: 5 * time.Second,
CheckRedirect: func(req *http.Request, via []*http.Request) error {
// disallow redirects to prevent SSRF via redirect chains
return http.ErrUseLastResponse
},
}
resp, err := client.Get(target)
if err != nil {
return c.String(http.StatusBadGateway, "error fetching url")
}
defer resp.Body.Close()
limited := io.LimitReader(resp.Body, 1<<20) // 1MB cap
body, _ := ioutil.ReadAll(limited)
return c.String(resp.StatusCode, string(body))
}
func main() {
e := echo.New()
e.GET("/vuln", vulnerableHandler)
e.GET("/safe", safeHandler)
e.Start(":8080")
}