Skip to content

Server Side Request Forgery (SSRF)

Description

Server-Side-Request-Forgery (SSRF) exploits backend systems that initiate requests to third parties. If user input is used in constructing or sending these requests, an attacker could supply malicious data to force the request to other systems or modify request data to cause unwanted actions. Ensure user input is not used directly in constructing URLs or URIs when initiating requests to third party systems from back end systems.

Examples

Insecure Code

go
resp, err := http.Get(userInput)

Secure Code

go
httpClient := &http.Client{ Transport: SafeTransport(clientConnectTimeout), }; resp, err := httpClient.Get(requestUrl)

Remediation

Use a safe HTTP client that disallows access to loopback and RFC-1918 addresses, restrict to known URIs or payloads, and consider using a server-side map to return URLs.

Rule Details

FieldValue
IDCODE-0789
CategoryWeb
SeverityMEDIUM
CWECWE-918
ConfidenceHIGH
ImpactHIGH
LikelihoodMEDIUM
ExploitabilityEASY
Tagsssrf, injection
OWASPA1:2017-Injection, A10:2021-Server-Side Request Forgery