Ssrf Server Side in Chi with Dynamodb

Server-side request forgery (SSRF) in a Chi application that interacts with Amazon DynamoDB can occur when user-controlled input is used to construct HTTP requests or to build DynamoDB endpoint configurations. Chi is a lightweight routing library for Common Lisp, and when request parameters are passed without validation into HTTP clients or AWS SDK configurations, an attacker may force the server to reach internal services or metadata endpoints. Because the AWS SDK for Lisp (or a similar integration) may rely on HTTP clients under the hood, SSRF vectors can emerge at the intersection of routing, HTTP client usage, and DynamoDB operations.

For example, if a Chi route extracts a hostname or port from a query parameter and uses it to call a DynamoDB-like service via an HTTP client, an attacker can supply values such as 169.254.169.254 (the AWS instance metadata service) or internal cluster IPs. This can lead to sensitive metadata exposure, SSRF-induced internal port scanning, or even chained attacks against other services that trust the originating server. In the context of DynamoDB, an SSRF flaw may not directly leak table data, but it can reveal information about the backend infrastructure, such as IAM roles attached to the instance, or enable tunneling into internal endpoints that accept DynamoDB-compatible traffic.

Common patterns that increase risk include: using unchecked user input to form HTTP URIs for service discovery, failing to restrict outbound destinations, and allowing dynamic configuration of AWS endpoints. Because SSRF exploits the server’s ability to make arbitrary network requests, the combination with DynamoDB integrations amplifies the potential for unintended information leakage or lateral movement within a private network. The vulnerability is not in DynamoDB itself, but in how the server routes and HTTP client configuration expose internal surfaces when handling requests.

Remediation focuses on strict input validation, whitelisting allowed destinations, and avoiding dynamic endpoint construction based on user data. When integrating Chi routes with DynamoDB, ensure that any parameters used to influence HTTP client behavior are constrained to known-safe values.

Example: Unsafe dynamic endpoint construction

(defun unsafe-endpoint (host port table)
  (let ((client (dex:make-client :base-url (format nil "http://~a:~a" host port))))
    (dex:get (str:concat "/?TableName=" table) :client client)))

An attacker could supply a malicious host to reach internal services. Instead, use a fixed, validated endpoint and avoid concatenating user input into URIs.

Example: Safe DynamoDB interaction in Chi

(defparameter *allowed-hosts* '("dynamodb.us-east-1.amazonaws.com"))

(defun safe-dynamodb-request (table)
  (let ((host (first *allowed-hosts*))
        (port 443)
        (client (dex:make-client :base-url "https://dynamodb.us-east-1.amazonaws.com")))
    (dex:get (str:concat "/?TableName=" (uri-encode table)) :client client)))

(defun endpoint-handler (req)
  (let ((table (quri:query-param req "table")))
    (if (and table (member table '("users" "orders") :test #'string=))
        (safe-dynamodb-request table)
        (hunchentoot:abort 400 "Invalid table"))))

In this approach, the Chi handler validates the table parameter against an allowlist before using it. The HTTP client uses a fixed, preconfigured base URL, eliminating the risk of SSRF via manipulated host or port values. Additional measures include disabling unnecessary HTTP methods, enforcing timeouts, and monitoring outbound connections as part of defense in depth.