[API Policies] URL Guardrail Policy Security Issue

[DakshithaS]

Overview

Critical Security Vulnerability - Server-Side Request Forgery (SSRF) vulnerability allows attackers to probe internal infrastructure.

---

Issue Details

Missing URL Validation Enables SSRF Attacks

File: urlguardrail.go (lines 293-313)

Description:
The checkURL and checkDNS methods make unrestricted network requests (HTTP HEAD and DNS lookups) to URLs extracted from payloads without validation. This enables Server-Side Request Forgery attacks.

Attack Vectors:

• Inject URLs targeting internal services
• Access cloud metadata endpoints (169.254.169.254)
• Perform reconnaissance on internal network topology
• Probe internal APIs and services

Required Validation:
Add validation before network requests to reject:

• Private IP ranges (10.x.x.x, 172.16-31.x.x, 192.168.x.x)
• Localhost/loopback addresses (127.0.0.1, ::1)
• Cloud metadata endpoints
• Non-HTTP(S) schemes

Impact:
Attackers can use the policy to probe internal infrastructure and access sensitive endpoints.

Reference

• Consolidate APIM policies into gateway-controllers repository gateway-controllers#1