Why Server-Side Request Forgery (SSRF) Defense Matters in Media Resolvers
How DNS pre-flight verification and Undici socket IP pinning neutralize TOCTOU rebinding attacks against cloud metadata.
1. The Anatomy of a DNS Rebinding (TOCTOU) Attack on Media Fetchers
Any web application that accepts a user-supplied URL to fetch remote metadata is a prime target for Server-Side Request Forgery (SSRF). Naive implementations validate the URL hostname once, and then pass the URL string to an HTTP client or media parser.
In a Time-of-Check to Time-of-Use (TOCTOU) DNS Rebinding attack, an attacker configures an authoritative DNS server with a 0-second TTL. The first DNS lookup returns a safe public IP to pass validation, while the second lookup—performed milliseconds later by the HTTP client—resolves to 169.254.169.254 (AWS/GCP Cloud Instance Metadata) or 127.0.0.1. StreamCatch eliminates this vector completely via Undici TCP socket IP pinning.
- Strict RFC 1918, CGNAT (100.64.0.0/10), Loopback, and IPv6 Link-Local filtration before any socket opens.
- Manual 3xx HTTP redirect inspection—every redirect hop undergoes full DNS pre-flight and allowlist validation.