SMohanta170638 (Community Member) asked a question.
I've below function block where Veracode is not reporting SSRF:
private static KeyValue GetConsulValue(string bearerToken, string spoolerId)
{
KeyValue obj = new KeyValue();
string result = null;
HttpWebResponse resp = null;
string URL = "";
if (String.IsNullOrEmpty(spoolerId))
{
URL = ConfigurationManager.AppSettings["SPSAzureFetchPrintersUrl"] +
ConfigurationManager.AppSettings["SPSAzureFetchPrintersTree"] + "/" +
ConfigurationManager.AppSettings["SPSAzureAtlasClient"] + "/" +
ConfigurationManager.AppSettings["SPSAzureAtlasEnvironment"] + "/" + "Spoolers/";
}
else
{
URL = ConfigurationManager.AppSettings["SPSAzureFetchPrintersUrl"] +
ConfigurationManager.AppSettings["SPSAzureFetchPrintersTree"] + "/" +
ConfigurationManager.AppSettings["SPSAzureAtlasClient"] + "/" +
ConfigurationManager.AppSettings["SPSAzureAtlasEnvironment"] + "/"
+ "Spoolers/" + spoolerId + "/Heartbeat/";
}
ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls | SecurityProtocolType.Tls11 | SecurityProtocolType.Tls12 | SecurityProtocolType.Tls13;
if(new LWValidation().Filter(URL))
{
HttpWebRequest reqObj = (HttpWebRequest)WebRequest.Create(URL);
reqObj.ContentLength = 0;
reqObj.Method = "GET";
reqObj.Headers.Add("Authorization", bearerToken);
reqObj.ContentType = "application/json";
resp = (HttpWebResponse)reqObj.GetResponse();
....
....
}
return obj;
}
But for below function Veracode is reporting SSRF:
public static string GetSpoolerHeartBeat(string bearerToken, string spooler_id)
{
try
{
string retVal = "";
HttpWebResponse resp = null;
ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls | SecurityProtocolType.Tls11 | SecurityProtocolType.Tls12 | SecurityProtocolType.Tls13;
if (!string.IsNullOrEmpty(spooler_id))
{
string URL = "";
URL = ConfigurationManager.AppSettings["SpoolerHBUrl"] + "?clientName=" + ConfigurationManager.AppSettings["SPSAzureAtlasClient"] +
"&environmentName=" + ConfigurationManager.AppSettings["SPSAzureAtlasEnvironment"] + "&spoolerID=" + spooler_id;
if (new LWValidation().Filter(URL))
{
HttpWebRequest reqObj = (HttpWebRequest)WebRequest.Create(URL);
reqObj.ContentLength = 0;
reqObj.Method = "POST";
reqObj.Headers.Add("Authorization", bearerToken);
reqObj.ContentType = "application/json";
resp = (HttpWebResponse)reqObj.GetResponse();
...
...
}
}
return retVal;
}
catch(Exception ex)
{
...
}
}
Both functions are similar except the URL pattern then why for first function SSRF is not reported but for second function it is reported.
.png){kind=logo}
Hello SMohanta170638,
I would recommend you contact our technical support team. Here's how you can log a case:
1. Navigate to the upper right corner of any page in the Community, and click on your user avatar.
2. Select Contact Support from the drop-down menu.
Open a case with Support, for Static Analysis and provide the steps you are taking to receive that error to better help assist the engineer.
Regards,
Fabiano
Veracode Inc.