Veracode Static Analysis will report a flaw with CWE 918 if it can detect that data from outside of the application (like an HTTP Request from a user, but also a file that may have been uploaded by a user, database data, webservice data, etc) is able to change the nature of a network request.

For example:

     public IActionResult ProxyImage(string image_host, string image_path)

    {

      string url = $"http://{image_host}.example.com/{image_path}";

      WebResponse myWebResponse = WebRequest.Create(url).GetResponse();

In this example an attacker might change image_host to for example: "10.0.1.1/admin.html#" which would make the url "http://10.0.1.1/admin.html#.example.com/".

This would allow an attacker to query endpoints on your internal network. For more information on this attack please see: https://www.owasp.org/index.php/Server_Side_Request_Forgery .

To secure your application please ensure you either do 1 of 2 things:

1. Reduce the input to a hardcodedPreferred and automatically as Veracode Static Analysis will automatically close the flaw. For example:

     public WebResponse ProxyImage(string image_host, string image_path)

    {

      string validated_image_host = AllowedHosts.Host1;

      if (image_host.Equals(AllowedHosts.Host2)) validated_image_host = AllowedHosts.Host2;

      string validated_avatar = AllowedAvatars.AvatarA;

      if (image_path.Equals(AllowedAvatars.AvatarB)) validated_avatar = AllowedAvatars.AvatarB;

      string url = $"http://{validated_image_host}.example.com/{validated_avatar}";

      WebResponse myWebResponse = WebRequest.Create(url).GetResponse();

2. Add dynamic validation and propose a mitigation by design ( https://help.veracode.com/reader/DGHxSJy3Gn3gtuSIN2jkRQ/~p4MSKOS8F8X8h0KwFTKoQ ). For example:

     public WebResponse ProxyImage(string image_host, string image_path)

    {

      var image_host_regex = new System.Text.RegularExpressions.Regex("^[a-z]{1,10}$");

      if (!image_host_regex.Match(image_host).Success)

      {

        throw new ArgumentException("Invalid image_host");

      }

      var image_path_regex = new System.Text.RegularExpressions.Regex("^/[a-z]{1,10}/[a-z]{1,255}.png$");

      if (!image_path_regex.Match(image_path).Success)

      {

        throw new ArgumentException("Invalid image_host");

      }

      string url = $"http://{image_host}.example.com/{image_path}";

      WebResponse myWebResponse = WebRequest.Create(url).GetResponse();

Please note that Veracode Static Analysis will not automatically close flaws based on custom validation as it is blind to any custom validation.

Please let me know if you have any remaining questions or concerns.

Thank you,

Boy Baukema

We have scanned our code through Veracode and it gives us Server-Side Request Forgery issue for below line of code. could you please help us to find out whats wrong into that line? Here is the code, HttpWebRequest req = (HttpWebRequest)WebRequest.Create(url); req.Method = "GET"; req.Accept = "text/plain"; HttpWebResponse res = (HttpWebResponse)req.GetResponse(); //Veracode Error Server-Side Request Forgery StreamReader sr = new StreamReader(res.GetResponseStream()); string sJSON = sr.ReadToEnd(); Here is the description from veracode, The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. KDealer

CWE-918 (Server-Side Request Forgery - SSRF) is a vulnerability where an application allows an attacker to induce the server to make a request to an arbitrary URL. When fixing this vulnerability in the context of a `WebRequest.GetResponse()` method call, you need to ensure that the URL being requested is validated and properly sanitized to prevent SSRF attacks.

Here's how you can address this issue:

1. Whitelist Allowed URLs: Limit the URLs that the application can request to a predefined whitelist of trusted domains. Only allow requests to these whitelisted domains. This prevents attackers from making requests to arbitrary or malicious URLs.

2. Input Validation: Validate user-supplied URLs to ensure they meet the expected format and only allow certain protocols (e.g., HTTP, HTTPS). Reject any URLs that do not adhere to the validation criteria.

3. URL Encoding: Encode user-supplied URLs properly before making the request. This helps prevent attackers from bypassing input validation by encoding malicious URLs in a way that might evade detection.

4. Restrict Access: If possible, restrict the scope of the `WebRequest.GetResponse()` method to internal or trusted resources only. Avoid allowing requests to external or untrusted resources whenever possible.

5. Use Safe APIs: If your programming language or framework provides safer alternatives to `WebRequest.GetResponse()` that automatically handle security concerns like SSRF, consider using those APIs instead.

CWE-918 (Server-Side Request Forgery - SSRF) is a vulnerability where an application allows an attacker to induce the server to make a request to an arbitrary URL. Brevard County Property Appraiser When fixing this vulnerability in the context of a `WebRequest.GetResponse()` method call, you need to ensure that the URL being requested is validated and properly sanitized to prevent SSRF attacks.