BDiep169241 (Community Member) asked a question.
Server Side Request Forgery (SSRF) HttpWebResponse
I'm currently getting an SSRF for the line
Dim XMLResponse As System.Net.HttpWebResponse = CType(XMLRequest.GetResponse(), System.Net.HttpWebResponse)
I'm unsure of how to fix this, is there a function I should be wrapping around a portion of this? I'm not seeing a URL coming back from this line to encode.
.png){kind=logo}
Veracode is probably flagging out of caution. Where does the url for the request come from and is it validated? Is it constant, predefined, constructed on the fly, or user defined? More context of the upstream and downstream code might help, too.
Here is a more detailed set of code
Private Function RequestUSPSValidation() As String
Dim XMLRequest As HttpWebRequest = HttpWebRequest.Create(BuildUSPSRequestString())
'need to hit it once to get the proxy, and then hand that off before we request the response
Dim XMLRequestProxy As HttpWebRequest = HttpWebRequest.Create("http://testing.ShippingAPIs.com/")
XMLRequestProxy.Proxy.GetProxy(New System.Uri("http://testing.ShippingAPIs.com/"))
XMLRequest.Credentials = CredentialCache.DefaultNetworkCredentials
'XMLRequestProxy.Proxy.Credentials = New NetworkCredential("r31564w", "[password]", "BCBST") 'nobody look, please.
XMLRequest.Proxy = XMLRequestProxy.Proxy
'
'XMLRequest.Credentials = New NetworkCredential("", "")
Dim XMLResponse As System.Net.HttpWebResponse = CType(XMLRequest.GetResponse(), System.Net.HttpWebResponse)
'MsgBox(response.StatusDescription) ' Display the status.
Dim XMLDataStream As System.IO.Stream = XMLResponse.GetResponseStream() ' Get the stream containing content returned by the server.
Dim XMLReader As New System.IO.StreamReader(XMLDataStream) ' Open the stream using a StreamReader for easy access.
Dim XMLResponseFromServer As String = XMLReader.ReadToEnd() ' Read the content.
'msgbox(responseFromServer) ' Display the content.
'Cleanup the streams and the response.
XMLReader.Close()
XMLDataStream.Close()
XMLResponse.Close()
Return XMLResponseFromServer
End Function
If the uri is not user controlled and there is no risk of them or anyone else injecting a uri, then this is a false positive and being flagged out of an abundance of caution.
Hi @BDiep169241 (Community Member),
Veracode Static Analysis reports flaws of CWE 918 when it can see that part of the request originates from outside of the application.
To fix this flaw we generally recommend using only hardcoded data. If this is not possible please ensure all request data is appropriately validated and/or encoded and document this in a mitigation proposal ( https://docs.veracode.com/r/improve_mitigation ) and request a review from your security team.
From the provided code it looks like "BuildUSPSRequestString()" is building the URL dynamically. Without more details about this function it is impossible to give you more precise remediation steps. If you would like more detailed remediation guidance I would recommend you schedule a consultation call to discuss.
You can check out this knowledge article (https://community.veracode.com/s/article/How-to-schedule-a-consultation-call) on how to schedule a consultation call with us.
Thank you,
Boy Baukema