# V5334. OWASP. Possible server-side request forgery. Potentially tainted data in the URL is used to access a remote resource.

The analyzer has detected that a remote resource is accessed using a user-provided and unverified URL. Relying on untrusted external data to generate an address can cause Server-Side Request Forgery (SSRF).

This vulnerability can be categorized under the OWASP Top 10 Application Security Risks classification as follows:

- A10:2021 – Server-Side Request Forgery (SSRF)

The example:

    public static class UrlController {
      private final String BASE_URL = "http://localhost/";

      protected void connect(HttpServletRequest req) throws IOException {
        String filter = req.getParameter("filter");
        URL url = new URL(BASE_URL + filter);
        url.openConnection();                      // <=
        //....
      }
    }

In this example, the `filter` variable may contain tainted data, since it originates from an external source and is used to form a server request to the resource whose address is stored in the `BASE_URL` variable.

This approach enables attackers to perform malicious actions by sending requests to resources to which they do not have direct access to.

Attackers can write the following to the `filter` variable:

    admin/delete?username=testSSRF

The final request looks like this:

    http://localhost/admin/delete?username=testSSRF

When a request is executed with such an address, attackers could delete a user.

Note. When mitigating SSRF, do not use deny lists or regular expressions because attackers can bypass them using the following techniques:

- Redirection: Attackers can host an external resource that redirects to another URL.
- Alternative IP representations, for example:

    http://2130706433/ = http://127.0.0.1
    http://0x7f000001/ = http://127.0.0.1

The example of protecting against SSRF using data validation:

    public static class UrlController {
      private final String BASE_URL;
      private final List<URL> whitelist;

      protected void connect(HttpServletRequest req) throws IOException {
        URL url = new URL(BASE_URL + req.getParameter("filter"));
        if (whiteList.contains(url)) {                    // <=
          url.openConnection();
          //....
        }
      }
    }

You can also use special URL encoders that escape the request. For example, a user can pass the following string as a parameter:

    ../admin/secure-info

The code that generates a request to a third-party resource looks like this:

    private final static String INTERNAL_URL = "http://localhost/service/";
    protected void connect(HttpServletRequest req) throws IOException {
      String filter = req.getParameter("filter");
      URL url = new URL(INTERNAL_URL + filter);
      url.openConnection();                       // <=
      //....
    }

If `../` is not escaped, the final request to the external resource will look like this:

    http://localhost/admin/secure-info

By using this address, attackers can manipulate third-party resources and gain access to server specifications, the user count, and other confidential data.

To prevent such attacks, escape the user request.

The example of a secure implementation:

    private final static String INTERNAL_URL = "http://localhost/service/";
    protected void connect(HttpServletRequest req) throws IOException {
      String filter = req.getParameter("filter");
      String encodedFilter = URLEncoder.encode(filter, "UTF_8");            // <=
      URL url = new URL(INTERNAL_URL + encodedFilter);
      url.openConnection();
      //....
    }

This diagnostic is classified as:

CWE-918 OWASP-5.2.6