ServerSideRequestForgery-end.inc.qhelp

<!DOCTYPE qhelp PUBLIC
  "-//Semmle//qhelp//EN"
  "qhelp.dtd">
<qhelp>
  <recommendation>

    <p>To guard against SSRF attacks you should avoid putting user-provided input directly
      into a request URL. On the application level, maintain a list of authorized URLs on the server and choose
      from that list based on the input provided. If that is not possible, one should verify the IP address for all user-controlled 
      requests to ensure they are not private. This requires saving the verified IP address of each domain,
      then utilizing a custom HTTP adapter to ensure that future requests to that domain use the verified IP address. 
      On the network level, you can segment the vulnerable application into its own LAN or block access to specific devices.
    </p>

  </recommendation>
  <example>

    <p>The following example shows code vulnerable to a full SSRF attack, because it
    uses untrusted input (HTTP request parameter) directly to construct a URL. By using
    <code>evil.com#</code> as the <code>target</code> value, the requested URL will be
    <code>https://evil.com#.example.com/data/</code>. It also shows how to remedy the
    problem by using the user input select a known fixed string.
    </p>

    <sample src="examples/ServerSideRequestForgery_full.py" />

  </example>
  <example>

    <p>
      The following example shows code vulnerable to a partial SSRF attack, because it
      uses untrusted input (HTTP request parameter) directly to construct a URL. By
      using <code>../transfer-funds-to/123?amount=456</code> as the
      <code>user_id</code> value, the requested URL will be
      <code>https://api.example.com/transfer-funds-to/123?amount=456</code>. It also
      shows how to remedy the problem by validating the input.
    </p>

    <sample src="examples/ServerSideRequestForgery_partial.py" />

  </example>
  <references>
    <li>
      <a href="https://owasp.org/www-community/attacks/Server_Side_Request_Forgery">OWASP SSRF article</a>
    </li>
    <li>
      <a href="https://portswigger.net/web-security/ssrf">PortSwigger SSRF article</a>
    </li>
  </references>
</qhelp>