V5334. OWASP. Possible server-side request forgery. Potentially tainted data in the URL is used to access a remote resource.

The analyzer has detected that a remote resource is accessed using a user-provided and unverified URL. Relying on untrusted external data to generate an address can cause Server-Side Request Forgery (SSRF).

This vulnerability can be categorized under the OWASP Top 10 Application Security Risks classification as follows:

• A10:2021 – Server-Side Request Forgery (SSRF)

The example:

public static class UrlController {
  private final String BASE_URL = "http://localhost/"; 
  
  protected void connect(HttpServletRequest req) throws IOException {
    String filter = req.getParameter("filter"); 
    URL url = new URL(BASE_URL + filter);
    url.openConnection();                      // <=
    //....
  }
}

In this example, the filter variable may contain tainted data, since it originates from an external source and is used to form a server request to the resource whose address is stored in the BASE_URL variable.

This approach enables attackers to perform malicious actions by sending requests to resources to which they do not have direct access to.

Attackers can write the following to the filter variable:

admin/delete?username=testSSRF

The final request looks like this:

http://localhost/admin/delete?username=testSSRF

When a request is executed with such an address, attackers could delete a user.

Note. When mitigating SSRF, do not use deny lists or regular expressions because attackers can bypass them using the following techniques:

• Redirection: Attackers can host an external resource that redirects to another URL.
• Alternative IP representations, for example:

http://2130706433/ = http://127.0.0.1 
http://0x7f000001/ = http://127.0.0.1 

The example of protecting against SSRF using data validation:

public static class UrlController {
  private final String BASE_URL; 
  private final List<URL> whitelist;
  
  protected void connect(HttpServletRequest req) throws IOException {
    URL url = new URL(BASE_URL + req.getParameter("filter"));
    if (whiteList.contains(url)) {                    // <=
      url.openConnection(); 
      //....
    }
  }
}

You can also use special URL encoders that escape the request. For example, a user can pass the following string as a parameter:

../admin/secure-info

The code that generates a request to a third-party resource looks like this:

private final static String INTERNAL_URL = "http://localhost/service/"; 
protected void connect(HttpServletRequest req) throws IOException {
  String filter = req.getParameter("filter");
  URL url = new URL(INTERNAL_URL + filter);
  url.openConnection();                       // <=
  //....
}

If ../ is not escaped, the final request to the external resource will look like this:

http://localhost/admin/secure-info

By using this address, attackers can manipulate third-party resources and gain access to server specifications, the user count, and other confidential data.

To prevent such attacks, escape the user request.

The example of a secure implementation:

private final static String INTERNAL_URL = "http://localhost/service/";
protected void connect(HttpServletRequest req) throws IOException {
  String filter = req.getParameter("filter");
  String encodedFilter = URLEncoder.encode(filter, "UTF_8");            // <=
  URL url = new URL(INTERNAL_URL + encodedFilter);
  url.openConnection();
  //....
}

This diagnostic is classified as:

Was this page helpful?

Message submitted.

Your message has been sent. We will email you at

If you do not see the email in your inbox, please check if it is filtered to one of the following folders:

• Promotion
• Updates
• Spam

If you can’t find an answer to your question, fill in the form below and our developers will contact you

By clicking this button you agree to our Privacy Policy statement