Linkerd SSRF detection

What is the "Linkerd SSRF detection?"

The "Linkerd SSRF detection" module is designed to detect SSRF (Server-Side Request Forgery) vulnerabilities in applications that use the Linkerd service mesh. SSRF vulnerabilities can allow attackers to make unauthorized requests to internal resources. This module focuses on identifying misconfigurations or vulnerabilities related to SSRF in Linkerd.

This module has a severity level of high, indicating that the detected vulnerabilities can have a significant impact on the security of the application.

Impact

If an SSRF vulnerability is present in an application using Linkerd, it can be exploited by attackers to bypass security controls and access internal resources. This can lead to unauthorized data exposure, privilege escalation, or even compromise of the entire system.

How the module works?

The "Linkerd SSRF detection" module works by analyzing the HTTP requests made by the application and applying matching conditions to identify potential SSRF vulnerabilities. It specifically targets requests that have the "interactsh_protocol" part set to "http".

One example of a matching condition is the presence of the "l5d-dtab" header in a GET request. This header specifies a mapping from service names to destination addresses. By analyzing the request headers and other relevant parameters, the module can determine if there is a potential SSRF vulnerability.

It is important to note that the module does not provide the actual JSON definitions or the specific details of the matching conditions. Instead, it focuses on the technical aspects of how the module operates and what it aims to detect.