# V5334\. OWASP\. Possible server\-side request forgery\. Potentially tainted data in the URL is used to access a remote resource\.

The analyzer has detected that a remote resource is accessed using a user\-provided and unverified URL\. Relying on untrusted external data to generate an address can cause Server\-Side Request Forgery \(SSRF\)\.

This vulnerability can be categorized under the OWASP Top 10 Application Security Risks classification as follows: 

* [A10:2021 – Server\-Side Request Forgery \(SSRF\)](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/)

The example:

```cpp
public static class UrlController {
  private final String BASE_URL = "http://localhost/"; 
  
  protected void connect(HttpServletRequest req) throws IOException {
    String filter = req.getParameter("filter"); 
    URL url = new URL(BASE_URL + filter);
    url.openConnection();                      // <=
    //....
  }
}
```

In this example, the `filter` variable may contain tainted data, since it originates from an external source and is used to form a server request to the resource whose address is stored in the `BASE_URL` variable\. 

This approach enables attackers to perform malicious actions by sending requests to resources to which they do not have direct access to\. 

Attackers can write the following to the `filter` variable: 

```cpp
admin/delete?username=testSSRF
```

The final request looks like this: 

```cpp
http://localhost/admin/delete?username=testSSRF
```

When a request is executed with such an address, attackers could delete a user\.

**Note**\. When mitigating SSRF, do not use deny lists or regular expressions because attackers can bypass them using the following techniques:

* Redirection: Attackers can host an external resource that redirects to another URL\.
* Alternative IP representations, for example:

```cpp
http://2130706433/ = http://127.0.0.1 
http://0x7f000001/ = http://127.0.0.1
```

The example of protecting against SSRF using data validation:

```cpp
public static class UrlController {
  private final String BASE_URL; 
  private final List<URL> whitelist;
  
  protected void connect(HttpServletRequest req) throws IOException {
    URL url = new URL(BASE_URL + req.getParameter("filter"));
    if (whiteList.contains(url)) {                    // <=
      url.openConnection(); 
      //....
    }
  }
}
```

You can also use special URL encoders that escape the request\. For example, a user can pass the following string as a parameter:

```cpp
../admin/secure-info
```

The code that generates a request to a third\-party resource looks like this:

```cpp
private final static String INTERNAL_URL = "http://localhost/service/"; 
protected void connect(HttpServletRequest req) throws IOException {
  String filter = req.getParameter("filter");
  URL url = new URL(INTERNAL_URL + filter);
  url.openConnection();                       // <=
  //....
}
```

If `../` is not escaped, the final request to the external resource will look like this:

```cpp
http://localhost/admin/secure-info
```

By using this address, attackers can manipulate third\-party resources and gain access to server specifications, the user count, and other confidential data\. 

To prevent such attacks, escape the user request\.

The example of a secure implementation: 

```cpp
private final static String INTERNAL_URL = "http://localhost/service/";
protected void connect(HttpServletRequest req) throws IOException {
  String filter = req.getParameter("filter");
  String encodedFilter = URLEncoder.encode(filter, "UTF_8");            // <=
  URL url = new URL(INTERNAL_URL + encodedFilter);
  url.openConnection();
  //....
}
```