SKorin905909 (Community Member) asked a question.
Veracode Static scan returns a CWE-918 f;aw just about everywhere that we make a call to HttpWebResponse response = (HttpWebResponse) request.GetResponse() on our C# code.
Our software makes calls to several different types of third-party APIs, mostly for processing payments or for verifying addresses. The URL, client id, and client secret are stored in a secure key system, and the data in the querystring is taken from HTML input.
For example:
// Create request url with authentication token.
StringBuilder urlBuilder = new StringBuilder();
//build URL base
urlBuilder.Append(EndpointUrl);
urlBuilder.Append("?auth-id=" + HttpUtility.UrlEncode(AuthenticationID));
urlBuilder.Append("&auth-token=" + HttpUtility.UrlEncode(AuthenticationToken));
//check input address international components and add to querystring
//Address1
if (!string.IsNullOrWhiteSpace(inputAddressInternational.Address1))
{
urlBuilder.Append("&address1=" + HttpUtility.UrlEncode(inputAddressInternational.Address1.Trim()));
}
//Address2
if (!string.IsNullOrWhiteSpace(inputAddressInternational.Address2))
{
urlBuilder.Append("&address2=" + HttpUtility.UrlEncode(inputAddressInternational.Address2.Trim()));
}
//Address3
if (!string.IsNullOrWhiteSpace(inputAddressInternational.Address3))
{
urlBuilder.Append("&address3=" + HttpUtility.UrlEncode(inputAddressInternational.Address3.Trim()));
}
//Locality
if (!string.IsNullOrWhiteSpace(inputAddressInternational.Locality))
{
urlBuilder.Append("&locality=" + HttpUtility.UrlEncode(inputAddressInternational.Locality.Trim()));
}
//Administrative Area
if (!string.IsNullOrWhiteSpace(inputAddressInternational.AdministrativeArea))
{
urlBuilder.Append("&administrative_area=" + HttpUtility.UrlEncode(inputAddressInternational.AdministrativeArea.Trim()));
}
//Postal Code
if (!string.IsNullOrWhiteSpace(inputAddressInternational.PostalCode))
{
urlBuilder.Append("&postal_code=" + HttpUtility.UrlEncode(inputAddressInternational.PostalCode.Trim()));
}
//Country - International so using CANADA (CAN)
if (!string.IsNullOrWhiteSpace(inputAddressInternational.Country))
{
urlBuilder.Append("&country= " + HttpUtility.UrlEncode(inputAddressInternational.Country.Trim()));
}
string strUrl = urlBuilder.ToString().Trim();
if (!string.IsNullOrEmpty(strUrl))
{
var url = new Uri(strUrl);
// Create a web request and set method to GET.
HttpWebRequest request = (HttpWebRequest) WebRequest.Create(url);
// get response.
HttpWebResponse response = (HttpWebResponse) request.GetResponse();
All of these parameters are strings. We don't really know what the valid values for these strings would be (in fact, that's the point of calling the third-party API, it validates an address). All the properties are URL encoded.
Am I missing something? Is there something else we need to be mitigating here? Exactly what attack am I trying to prevent. Does somebody have an example?
.png){kind=logo}
Hi @SKorin905909 (Community Member) ,
Recent examples of vulnerabilities due to Server-Side Request Forgery include:
Veracode Static Analysis supports detection of Server-Side Request Forgery by reviewing for all requests made by the application if data from outside of the application (for example from a users http request, but also from the database, file or another service response).
Veracode Static Analysis will only automatically close this flaw if it no longer sees this input coming from an outside source (for example by hardcoding the data).
If you need more flexibility in using outside data in composing a request the Veracode Application Security Consulting group typically recommends the following:
* Be very careful with any dynamic data allowed in the host part of a URL, have a list of allowed hosts only.
* Use absolute hosts only, guard ensure you throw an exception if the hostname is empty.
* Be very careful with any dynamic data allowed in the path part of a URL, have a list of allowed paths only.
* URLEncode any dynamic data going into the query string or after the # symbol.
The only recommendation I would have for the code snippet above would be to ensure that "EndpointUrl" is not empty and originates from properly controlled configuration.
After this please document in a mitigation proposal ( https://help.veracode.com/r/improve_mitigation ) that you have reviewed this request and all dynamic data is correctly used.
An example of a good Mitigation Proposal would be:
Technique: M2 Establish and maintain control over all of your outputs.
Specifics: HTTP Request done to verify address. Host name originates from profile based property file (for example production.properties), if no hostname is set a RuntimeException is thrown. All other data is passed in query string an is encoded with URLEncode.
Remaining Risk: None
Verification: Manual source code review & unit tests on AddressVerificationService
Though it is your organization that reviews and accepts or rejects these, so do check with them for best practices if you have any questions or concerns.
You then need to contact your organizations security team (this is not done automatically) and request a mitigation approver to review your mitigation proposal.
Thank you,
Boy Baukema