Report IMDS attacks

Author: hansott

agent_api/src/main/java/dev/aikido/agent_api/vulnerabilities/Vulnerabilities.java

@@ -39,6 +39,14 @@ public String getKind() {
             return "ssrf";
         }
     }
+    public static final class StoredSSRFVulnerability implements Vulnerability {
+        @Override
+        public Detector getDetector() { return null; }
+        @Override
+        public String getKind() {
+            return "stored-ssrf";
+        }
+    }
     public static final class ShellInjectionVulnerability implements Vulnerability {
         @Override
         public Detector getDetector() { return new ShellInjectionDetector(); }

agent_api/src/main/java/dev/aikido/agent_api/vulnerabilities/ssrf/SSRFDetector.java

@@ -23,12 +23,50 @@ public Attack run(String hostname, int port, List<String> ipAddresses, String op
             return null;
         }
 
-        if (resolvesToImdsIp(new HashSet<>(ipAddresses), hostname)) {
-            // An attacker could have stored a hostname in a database that points to an IMDS IP address
-            // We don't check if the user input contains the hostname because context might not be available
+        String imdsIp = resolvesToImdsIp(new HashSet<>(ipAddresses), hostname);
+        if (imdsIp != null) {
+            // Check if hostname is in user input (context available)
+            ContextObject context = Context.get();
+            if (context != null) {
+                FindHostnameInContext.Res attackFindings = findHostnameInContext(hostname, context, port);
+                if (attackFindings != null) {
+                    // Regular SSRF - hostname found in user input
+                    return new Attack(
+                            operation,
+                            new Vulnerabilities.SSRFVulnerability(),
+                            attackFindings.source(),
+                            attackFindings.pathToPayload(),
+                            Map.of(
+                                "hostname", hostname,
+                                "privateIP", imdsIp
+                            ),
+                            attackFindings.payload(),
+                            getCurrentStackTrace(),
+                            context.getUser()
+                    );
+                }
+            }
+
+            // Stored SSRF - no context or hostname not in user input
+            Attack storedSsrfAttack = new Attack(
+                    operation,
+                    new Vulnerabilities.StoredSSRFVulnerability(),
+                    null, // source is null for stored attacks
+                    "", // path is empty
+                    Map.of(
+                        "hostname", hostname,
+                        "privateIP", imdsIp
+                    ),
+                    hostname, // payload is the hostname
+                    getCurrentStackTrace(),
+                    null // user is null for stored attacks
+            );
+
             if(shouldBlock()) {
                 throw SSRFException.get();
             }
+
+            return storedSsrfAttack;
         }
         if (!containsPrivateIP(ipAddresses)) {
             // No real danger, returning.

agent_api/src/main/java/dev/aikido/agent_api/vulnerabilities/ssrf/imds/Resolver.java

@@ -5,19 +5,19 @@
 public final class Resolver {
     private Resolver() {}
     /**
-     * Returns boolean value that's true if this is an IMDS IP/Hostname
+     * Returns the IMDS IP if found, otherwise null
      */
-    public static boolean resolvesToImdsIp(Set<String> resolvedIpAddresses, String hostname) {
+    public static String resolvesToImdsIp(Set<String> resolvedIpAddresses, String hostname) {
         // Allow access to Google Cloud metadata service as you need to set specific headers to access it
         // We don't want to block legitimate requests
         if (TrustedHosts.isTrustedHostname(hostname)) {
-            return false;
+            return null;
         }
         for (String ip : resolvedIpAddresses) {
             if (IMDSAddresses.isImdsIpAddress(ip)) {
-                return true;
+                return ip;
             }
         }
-        return false;
+        return null;
     }
 }

agent_api/src/test/java/vulnerabilities/ssrf/ResolverTest.java

@@ -7,24 +7,24 @@
 import java.util.Set;
 
 import static dev.aikido.agent_api.vulnerabilities.ssrf.imds.Resolver.resolvesToImdsIp;
-import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNull;
 
 public class ResolverTest {
     @Test
     void testResolvesToImdsIp_WithTrustedHostname() {
         Set<String> resolvedIps = new HashSet<>();
         resolvedIps.add("192.168.1.1"); // Non-IMDS IP
 
-        assertFalse(Resolver.resolvesToImdsIp(resolvedIps, "metadata.google.internal"));
+        assertNull(Resolver.resolvesToImdsIp(resolvedIps, "metadata.google.internal"));
     }
 
     @Test
     void testResolvesToImdsIp_WithImdsIp() {
         Set<String> resolvedIps = new HashSet<>();
         resolvedIps.add("169.254.169.254"); // IMDS IP
 
-        assertTrue(Resolver.resolvesToImdsIp(resolvedIps, "example.com"));
+        assertEquals("169.254.169.254", Resolver.resolvesToImdsIp(resolvedIps, "example.com"));
     }
 
     @Test
@@ -33,7 +33,7 @@ void testResolvesToImdsIp_WithMultipleResolvedIps_OneImdsIp() {
         resolvedIps.add("192.168.1.1"); // Non-IMDS IP
         resolvedIps.add("fd00:ec2::254"); // IMDS IP
 
-        assertTrue(Resolver.resolvesToImdsIp(resolvedIps, "example.com"));
+        assertEquals("fd00:ec2::254", Resolver.resolvesToImdsIp(resolvedIps, "example.com"));
     }
 
     @Test
@@ -42,7 +42,7 @@ void testResolvesToImdsIp_WithNoImdsIp() {
         resolvedIps.add("192.168.1.1"); // Non-IMDS IP
         resolvedIps.add("10.0.0.1"); // Another Non-IMDS IP
 
-        assertFalse(Resolver.resolvesToImdsIp(resolvedIps, "example.com"));
+        assertNull(Resolver.resolvesToImdsIp(resolvedIps, "example.com"));
     }
 
     @Test
@@ -51,14 +51,14 @@ void testResolvesToImdsIp_WithMultipleResolvedIps_NoImdsIp() {
         resolvedIps.add("192.168.1.1"); // Non-IMDS IP
         resolvedIps.add("10.0.0.1"); // Another Non-IMDS IP
 
-        assertFalse(Resolver.resolvesToImdsIp(resolvedIps, "example.com"));
+        assertNull(Resolver.resolvesToImdsIp(resolvedIps, "example.com"));
     }
 
     @Test
     void testResolvesToImdsIp_WithMultipleResolvedIps_OnlyTrustedHostname() {
         Set<String> resolvedIps = new HashSet<>();
         resolvedIps.add("169.254.169.254"); // IMDS IP
 
-        assertFalse(Resolver.resolvesToImdsIp(resolvedIps, "metadata.google.internal"));
+        assertNull(Resolver.resolvesToImdsIp(resolvedIps, "metadata.google.internal"));
     }
 }