flawopen.com/Server-Side Request Forgery/PHP

Server-Side Request Forgery in PHP

Key terms on this page

FILTER_FLAG_NO_PRIV_RANGE

PHP filter flag that rejects RFC 1918 private IPv4 addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).

CURLOPT_FOLLOWLOCATION

cURL option that follows 3xx HTTP redirects. If enabled without IP verification on redirect, attackers bypass filters.

What's happening

In PHP, file_get_contents($url) or naive curl_exec($ch) fetches user-supplied URLs without restricting IP addresses.

Real-world impact

Vulnerable vs. fixed

<?php
// VULNERABLE: file_get_contents on user-controlled URL
$url = $_GET['url'];

// Attacker input: http://169.254.169.254/latest/meta-data/
$content = file_get_contents($url);

echo $content;
?>

<?php
// HARDENED: Parse URL, resolve DNS, filter private IPs, and disable redirects
$url = $_GET['url'] ?? '';

$parsed = parse_url($url);
if (!$parsed || !in_array(strtolower($parsed['scheme'] ?? ''), ['http', 'https'], true)) {
    http_response_code(400);
    exit('Invalid URL scheme');
}

$host = $parsed['host'] ?? '';
$ips = gethostbynamel($host);

if (!$ips) {
    http_response_code(400);
    exit('Unable to resolve host');
}

// Check every resolved IP address
foreach ($ips as $ip) {
    if (!filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) {
        http_response_code(403);
        exit('Access to private/internal address denied');
    }
}

// Fetch using cURL with redirects disabled
$ch = curl_init($url);
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_FOLLOWLOCATION => false, // Prevent redirect bypasses
    CURLOPT_TIMEOUT        => 3,
    CURLOPT_PROTOCOLS      => CURLPROTO_HTTP | CURLPROTO_HTTPS,
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;
?>

Why the fix works

The code validates schemes with parse_url and resolves all IPs with gethostbynamel. filter_var(..., FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) rejects internal addresses, while CURLOPT_FOLLOWLOCATION => false prevents 302 bypasses.

Gotchas

Common misconceptions

How to check if you're affected

Prevention checklist

• ✓Use cURL with CURLOPT_FOLLOWLOCATION => false
• ✓Validate IPs with FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE
• ✓Restrict protocols with CURLOPT_PROTOCOLS => CURLPROTO_HTTP | CURLPROTO_HTTPS
• ✓Set explicit timeouts (<= 3s)

FAQ

References

• CWE-918 Specification
• OWASP Security Cheat Sheet Series