JJunior331643 (Community Member) asked a question.
Need help to fix Server-Side Request Forgery
I have a .net app running in container in a specific moment I need to consult information from other APP by accessing an API.
I receive an URL from appsettings which stays on Secrets.
Veracode is pointing a SSRF error but I changed the code and the error remains there.
As you can see the error points to line 97
This is the code...
The changes I made are...
I hided all the sensitive data from the print screen.
I am using UriBuilder to parse and validate the URL and I try another way to pass data to the API and I still get the error on the same line when httpclient uses the GetAsync method to retrieve data.
Any ideas how can I fix this SSRF issue?
.png){kind=logo}
Hello @JJunior331643 (Community Member),
The recommendation for mitigating against SSRF flaws is to use strict validation on the untrusted data used to build the requested URL. Typically, Veracode Static Analysis will not automatically close a flaw such as this, as long as there are variables in use that contain untrusted data. The analysis engine detects this flaw using data-flow analysis and will not introspect the conditional logic used in validation. If you believe the validation you have done is sufficient, you will need to raise a mitigation for approval by your security team.
Kind regards,
Duncan