SNI Proxy SSRF: Misconfigurations & Defense | Acunetix

SNI Proxy SSRF: Misconfigurations & Defense

This article was originally published by LOGON’s partner Acunetix. Click here to view the original article.

SNI proxy SSRF is a lesser-known but high-impact vulnerability where misconfigured proxies route traffic based on attacker-controlled TLS metadata. Under specific conditions, this can expose internal services and even cloud metadata endpoints in AWS and Azure.

What is SNI proxy SSRF?

Server Name Indication (SNI) allows clients to specify which hostname they want to connect to during the TLS handshake. An SNI proxy uses this value to decide which backend system should handle the connection.

If the SNI value is used directly in routing logic without strict validation, attackers can turn the proxy into a forwarding mechanism to reach:

Internal services
Management interfaces
Cloud metadata endpoints (AWS IMDS, Azure IMDS)

When is it exploitable?

Condition	Risk
Direct mapping of SNI to backend destinations	Attacker controls where traffic is sent
No strict allowlist of backends	Dynamic resolution to internal IPs
TLS termination with flexible forwarding	Attacker-controlled methods/headers reach internal services
Proxy can reach metadata endpoints	Access to credentials and tokens
No defensive controls at proxy layer	Requests forwarded that should never leave the edge

Cloud-specific risks:

AWS IMDSv2 – Requires PUT request with X-aws-ec2-metadata-token-ttl-seconds header. Exploitation is more realistic when the proxy runs on the same instance.
Azure IMDS – Requires Metadata: true header. Impact is highest when managed identity has useful permissions.

How to reduce SNI proxy SSRF risk:

Defense	Action
Avoid client-controlled routing	Don’t construct upstream destinations from `$ssl_preread_server_name` without allowlisting
Enforce allowlists	Only route to explicitly defined, trusted destinations
Block metadata endpoints	Restrict access to `169.254.169.254` using proxy rules and host firewalls
Harden DNS resolution	Prevent untrusted input from influencing backend resolution
Use cloud-native protections	Enforce IMDSv2 on AWS; use least-privilege managed identities on Azure
Monitor and test	Include reverse proxies and load balancers in security reviews

Key takeaway: SNI proxy SSRF often goes unnoticed because proxy configurations are treated as infrastructure concerns, not application attack surface. Testing should include edge-routing behavior, not just application routes.

Worried about SSRF in your cloud environment?

LOGON Software Asia – the trusted Acunetix distributor for Hong Kong, India, Nepal, Thailand, Sri Lanka, Maldives, Cambodia, and Bangladesh – offers:

✅ Free Proof of Concept (POC)
✅ Preferred regional pricing
✅ Priority technical support

Find, fix, and prevent vulnerabilities

Acunetix is an application security testing solution for securing your websites, web applications, and APIs

Solution Highlight

Get started with Acunetix

Book a live demo with our specialist to discover how Acunetix can quickly find and fix the vulnerabilities that put your web applications at risk of attack.

Acunetix Blog, Blog