SSRF Mitigation Recommendations

Server-Side Request Forgery (SSRF) attacks allow an attacker to manipulate the server-side application to make requests to an unintended location.

PPM implements the SSRF mitigation by validating the host header of each request to which PPM is redirected. To enable the mitigation, set the following parameters to true:

• CHECK_HOST_HEADER_WHEN_REDIRECT. When this parameter is set to true, when a request needs to be redirected, PPM checks the host header's domain of the request. If the host header is not the same as the base URL, the request is rejected.

• dashboard.CHECK_HOST_HEADER_WHEN_REDIRECT. When this parameter is set to true, when a request received by PPM dashboard pages needs to be redirected, PPM checks the host header's domain of the request. If the host header is not the same as the base URL, the request is rejected.

  Note: You can enable this parameter only in the server.conf file.

  For details on how to modify the server parameters, see Configure server configuration parameters .