shahidsitecore (Community Member) asked a question.
Need to fix CWE ID 918 in HTTP request
We have similar code to execute HTTP request and varacode giving error on this.
It all looks good and not able to find how to fix it.
We have below line of code
private HttpResponseMessage GetResponseFrom Service(HttpsRequestMessage httpRequestMessage, string proxyType)
{
response = httpsRequestMessage != null ? HttpClientHelper.GetHttpClient().sendasync(httpRequestMessage).Result : null;
}
below we have HttpClient object
public static HttpClient GetHttpClient() {return httpclinet}
What validation we can put so that this flaw resolved
.png){kind=logo}
Hi @shahidsitecore (Community Member),
Veracode Static Analysis reports CWE 918 (Server-Side Request Forgery (SSRF)) when it detects that an HTTP Request that is sent out from the application contains input from outside of the application (for example from an HTTP Request, but also from a file, database result, web service response, etc.).
The concern is that an attacker might be able to abuse this input to change the request being done to access (internal) resources that they should not have access to. For more information on the risk for this flaw please see: https://www.owasp.org/index.php/Server_Side_Request_Forgery .
In your particular example, you seem to be triggering an HTTP request to the URL specified in the `RequestUri` property of `httpRequestMessage`. The only thing that Veracode Static Analysis will automatically detect as remediation for this flaw category is to change the input to be hardcoded (or check against an allow-list). If this is not possible, please make sure to validate all user-controlled parts of the URL e.g. against a regex that checks if they are alphanumeric. An example regex would be `(^[a-zA-Z0-9]{1,50}$` (without the ticks).
Please note that Veracode Static Analysis cannot automatically detect dynamic validation, such as a regex, and you would have to propose a mitigation and discuss it with your organization's Security Team. The following link describes in more detail how to do this: https://docs.veracode.com/r/improve_mitigation .
Thank you,
Florian Walter
The following Cheat Sheet provides by OWASP may also be helpful: https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html
Thanks Florian for your reply.
We already using hardcoded Baseaddress that we are reading from config file as shown below code
static HttpClientHelper()
{
// for now we are not using it as we want to resuse the connection so Removing the below socket
//var socketsHandler = new System.Net.Http.SocketsHttpHandler
//{
// PooledConnectionLifetime = TimeSpan.FromSeconds(60),
// PooledConnectionIdleTimeout = TimeSpan.FromMinutes(10),
//};
httpClient = new HttpClient();
APIMAndGreenerHttpClient = new HttpClient() { BaseAddress = new Uri(ConfigurationManager.AppSettings[Constants.APIHost.APIMBaseUrl]) };
ForgeRockHttpClient = new HttpClient() { BaseAddress = new Uri(ConfigurationManager.AppSettings[Constants.APIHost.ForgerockHostName]) };
SFMCHttpClient = new HttpClient() { BaseAddress = new Uri(ConfigurationManager.AppSettings[Constants.APIHost.SFMCHost]) };
WisdomPanelHttpClient = new HttpClient() { BaseAddress = new Uri(!string.IsNullOrWhiteSpace(ConfigurationManager.AppSettings[Constants.APIHost.WisdomPanelUrl]) ? ConfigurationManager.AppSettings[Constants.APIHost.WisdomPanelUrl] : string.Empty) };
APIMLoginHttpClient = new HttpClient() { BaseAddress = new Uri(ConfigurationManager.AppSettings[Constants.APIHost.APIMLogin]) };
SFMCAuthenticationHttpClient = new HttpClient() { BaseAddress = new Uri(ConfigurationManager.AppSettings[Constants.APIHost.SFMCAuthenticationHost]) };
FacebookGraphApiUrl = new HttpClient() { BaseAddress = new Uri(ConfigurationManager.AppSettings[Constants.APIHost.FacebookGraphApiUrl]) };
BitlyHttpClient = new HttpClient() { BaseAddress = new Uri(ConfigurationManager.AppSettings[Constants.APIHost.BitlyApiUrl]) };
}
Also we tried with below condition
if (httpRequestMessage.RequestUri.Host.Contains("marketingcloudapis.com"))
{
response = httpRequestMessage != null ? HttpClientHelper.GetSFMCHttpClient().SendAsync(httpRequestMessage).Result : null;
}
But nothing is working please help us how we can resolve this flaw.
Thanks for your help
Hi @shahidsitecore (Community Member),
Please note that Veracode Static Analysis cannot automatically detect anything for SSRF other than hardcoding the address or an allow-list validation, and you would have to propose a mitigation and discuss it with your organization's Security Team.
If the base address is an FQDN with the protocol specified and is hardcoded or from an administrator-controlled property file, the risk is already very limited. On top of that, I would recommend applying dynamic validation on all parts of the URL that are controlled from outside the application. Ideally, you would want to apply URL encoding as well as a regex validation. For example, the following regex makes sure that a string contains between 1 and 50 alphanumeric characters: `^[a-zA-Z0-9]{1,50}$` (without the ticks). This would be a fantastic form of input validation.
Using a `String.Contains` approach is never a good idea for hosts as this check might be bypassable for example via "super-evil-marketingcloudapis.com" (this is more of a risk for Open Redirects though) or "super-sensitive.marketingcloudapis". You should instead always make sure that the whole host matches e.g. "marketingcloudapis.com", or apply an allow-list in case multiple subdomains are allowed.
Thank you,
Florian Walter