Hello @BDulla814157 (Community Member)​ ,

Veracode Static Analysis reports flaws of CWE-918 Server-Side Request Forgery (SSRF) when it detects a HTTP Request that is sent out from the application, containing input from outside of the application (for example from a HTTP Request, a value from a file, a database result, webservice response, etc.).

The concern is that an attacker might be able to abuse this input, to change the request being done to access (internal) resources that they should not have access to. In the above scenario, the BaseAddress was probably retrieved from a property file/database or contains user derived data that could have been potentially modified or tampered. For more information on the risk for this flaw please see: https://www.owasp.org/index.php/Server_Side_Request_Forgery and https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html

The only thing that Veracode Static Analysis will automatically detect as a remediation for this flaw category is to change the tainted variable to be a hardcoded URL value. If this is not possible, we recommend that you apply dynamic validation on the URL(as a combination of an allowed list of valid hostnames and regex pattern checks on input parameters that are appended to the URL) . But this will not be automatically detected by Veracode Static Analysis and must then be documented in a Mitigation by Design mitigation proposal and reviewed by your security team.

You can find more information on how to do mitigation proposals on our helpcentre: https://docs.veracode.com/r/improve_mitigation

Regards,

Sounderya