Rp100705 (Community Member) asked a question.
Veracode detects the SSRF flaw in the below code. The baseUrl is hardcoded and coming from the Application configuration file and don't see any vulnerability, so please help me to fix this flaw.
private async Task<ProductModel> GetProductItem(string productNumber)
{
using (var httpClient = GetHttpClientInstance())
{
var strbFilter =$"$filter=productNo eq '{productNumber}'";
var filterUri = $"product?{strbFilter}";
var result = await httpClient.GetAsync(filterUri); //Veracode detects CWE ID 918 (SSRF)
if (result.IsSuccessStatusCode)
{
var productItem = await result.Content.ReadAsStringAsync();
var productModelResponse = JsonConvert.DeserializeObject<ProductModel>(productItem);
return productModelResponse
}
return null;
}
}
.png){kind=logo}
Hi @Rp100705 (Community Member)
Well the issue is that the request's URL is provided by a configuration setting which is considered untrusted since the file would need to have appropriate access controls and follow a principle of least privilege. On top of that, since this is a configurable URL, it may be worth adding additional input validation on the base URL provided, such as ensuring the expected protocol is used (HTTPS), however, at the end of the day the issue boils down to is the host correct, so ensuring the constructed URL has the expected domain and port.
Mitigations can be combined to severely limit these attacks:
a) Validate the untrusted data used to create the web-request and, additionally, validate the end-result URL before performing the request.
b) Whitelist a small number of domains & hosts and allow requests only to those.
c) Limit connections to only port 80 (For HTTP URL) and port 443 (for HTTPS) to prevent port scanning.
d) DNS Resolution: Resolve the IP of the target host, to ensure that IP is for that external host. (and not the internal IP)
e) Disable access to any protocol other than HTTP and HTTPS
In such cases, we recommend you raise the proposal using the action 'Mitigate By Design' option. Ensure sufficient documentation is provided and it needs to review by your security team for the approval of the mitigation.
Regards
Kashif