Ssrf Server Side with Mutual Tls
How SSRF Server-Side Manifests in Mutual TLS
Server-Side Request Forgery (SSRF) in Mutual TLS environments presents unique challenges because the attacker can exploit both the client authentication and the trust established through certificate-based verification. In Mutual TLS, the server validates the client's certificate before establishing a connection, creating a false sense of security that can be leveraged by SSRF attacks.
The most common SSRF pattern in Mutual TLS occurs when an application accepts user-controlled URLs for backend requests. Consider a payment processing system that accepts webhook URLs from merchants. The system uses Mutual TLS to authenticate with the merchant's endpoint, but an attacker can supply a URL pointing to internal services that also use Mutual TLS authentication.
Mutual TLS-Specific Detection
Detecting SSRF in Mutual TLS environments requires specialized scanning that understands both the TLS handshake and the certificate validation process. Traditional SSRF scanners that only test HTTP endpoints miss the nuances of mTLS authentication.
The detection process begins with identifying endpoints that accept URLs as parameters and then testing them with a variety of target URLs. For Mutual TLS detection, the scanner must maintain a pool of valid client certificates and attempt connections to both external and internal targets.