SSingh011905 (Community Member) asked a question.
Fixing CWE 918 flaw
Veracode reported SSRF 918 flaw at line no. 2. What are the way we can fix this. We have gone through few suggestions on hardcoding values but that will not help because "response" query string vary on each request. Tried whitelisting domain but didn't help. Do we need to change the overall logic for this fix?
public static CaptchaResponse ValidateCaptcha(string response)
{
1. string key = ConfigurationManager.AppSettings["privatekey"];
2. var client = new WebClient();
3. var jsonResult = client.DownloadString(string.Format("https://www.google.com/recaptcha/api/siteverify?secret={0}&response={1}", key, response));
}
Found below link but there is no response.
.png){kind=logo}
Hi @SSingh011905 (Community Member)
Untrusted input is used in the creation of a web-request which possibly allows an attacker to perform unauthorized requests to internal or external systems. An attacker can use this to interact with internal services or disclose information or even local server files
Well the issue is that the request's URL is provided by a configuration setting which is considered untrusted since the file would need to have appropriate access controls and follow a principle of least privilege. On top of that, since this is a configurable URL, it may be worth adding additional input validation on the base URL provided, such as ensuring the expected protocol is used (HTTPS), however, at the end of the day the issue boils down to is the host correct, so ensuring the constructed URL has the expected domain and port.
Mitigations can be combined to severely limit these attacks:
a) Validate the untrusted data used to create the web-request and, additionally, validate the end-result URL before performing the request.
b) Whitelist a small number of domains & hosts and allow requests only to those.
c) Limit connections to only port 80 (For Http URL) and port 443 (for https) to prevent port scanning.
d) DNS Resolution: Resolve the IP of the target host, to ensure that IP is for that external host. (and not the internal IP)
e) Disable access to any protocol other than HTTP and HTTPS
If you have any questions on this I would recommend scheduling a Consultation with a Veracode Application Security Consultant. You can find more on how to do this here: https://help.veracode.com/reader/_xqy2rBkFBfaxzuiNu~wsg/kAO0UeevRvOPnidK6_e5IA .
Regards
Kashifali