SAriyandath356188 (Community Member) asked a question.
Hi,
I tried to implement the solution provided in this community( how to fix cwe-918 veracode flaw on webrequest getresponce method). Unfortunately that solution is not working form me.
This line is throwing the exception:
var response = await httpClient.GetAsync(request);
Here is the code sample:
public class ApiManager
{
private HttpClient httpClient = new HttpClient();
public void PopulateHttpClient(EnvironmentModel environment)
{
httpClient.BaseAddress = new Uri(environment.ApiUrl);
httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Basic",
Helper.Base64Encode($"{environment.sername}:{environment.Password}"));
}
public async Task<Person> GetPerson(IndexViewModel model)
{
model.Person = await Helper.GetJson($"persons/{model.Id}", httpClient);
if (model.Person != null)
{
return DeserializeJson<Person>(model.Person);
}
return null;
}
}
public static class Helper
{
public static async Task<string> GetJson(string request, HttpClient httpClient)
{
string responseMessage = null;
try
{
var regex_URL = new System.Text.RegularExpressions.Regex(@"^(ht|f)tp(s?)\:\/\/[0-9a-zA-Z]([-.\w]*[0-9a-zA-Z])*(:(0-9)*)*(\/?)([a-zA-Z0-9\-\.\?\,\'\/\\\+&%\$#_]*)?$");
if (!regex_URL.Match(httpClient.BaseAddress.ToString()).Success)
{
throw new ArgumentException("Invalid host");
}
var regex_path = new System.Text.RegularExpressions.Regex("^([a-z]).*?(\\d+)$");
if (!regex_path.Match(request).Success)
{
throw new ArgumentException("Invalid path");
}
var response = await httpClient.GetAsync(request);
try
{
responseMessage = await response.Content.ReadAsStringAsync();
return ConvertToJsonFormat(responseMessage);
}
catch (Exception)
{
return null;
}
}
catch (Exception e)
{
if (string.IsNullOrWhiteSpace(responseMessage))
{
return e.GetBaseException().Message;
}
else
{
return responseMessage + "\r\n" + e.GetBaseException().Message;
}
}
}
}
.png){kind=logo}
Hi @SAriyandath356188 (Community Member) ,
Veracode Static Analysis reports flaws of CWE-918 Server-Side Request Forgery (SSRF) when it detects that an HTTP Request that is sent out from the application contains input from outside of the application (for example from an HTTP Request, but also from a file, database result, webservice response, etc.).
The concern is that an attacker might be able to abuse this input to change the request being done to access (internal) resources that they should not have access to. For more information on the risk for this flaw please see: https://www.owasp.org/index.php/Server_Side_Request_Forgery .
The only thing that Veracode Static Analysis will automatically detect as a remediation for this flaw category is to change the input to be hardcoded. If this is not possible we recommend that you apply dynamic validation (for example with a regex) but this will not be automatically detected by Veracode Static Analysis and must then be documented in a Mitigation by Design mitigation proposal. You can find more information on how to do mitigation proposals on our help centre: https://docs.veracode.com/r/improve_mitigation
Please note that after proposing a mitigation you must contact your security team to have it reviewed.
The given example appears to take a model identifier and put it in the URL used in an internal request. We would recommend validating the ID per the rules you have for this datatype (typically this should only be alphanumeric and less than 255 characters) and URLencode it before appending it to a URL.
The given Helper class verifies too late, after the user input has been concatenated with the trusted URL and so is not able to remove any security risk instead it appears to simply check for a valid URL, which may reduce bugs but not specifically security risk.
Thank you,
Boy Baukema