Unsanitized user input in HTTP request (SSRF)

• Rule ID: go_gosec_injection_ssrf_injection
• Languages: go
• Source: ssrf_injection.yml

Description

Including unsanitized user input in HTTP requests puts your application at risk of Server-Side Request Forgery (SSRF). This is a security vulnerability that occurs when a server-side application makes HTTP requests to arbitrary URLs controlled by the user. SSRF can be exploited by attackers to target internal systems behind firewalls that are otherwise inaccessible from the external network, by tricking the server into making requests to these systems.

Remediations

• Do not use direct user input to construct URLs for backend requests. If user input is necessary, ensure it is strictly validated or sanitized to prevent malicious manipulation.
• Do use a safelist or predefined mapping when incorporating user input in URLs. This ensures that your application only redirects users to safe and intended destinations.

  safeURLs := map[string]string{
      "key1": "https://safe-domain1.com",
      "key2": "https://safe-domain2.com",
  }
  requestedKey := getUserInput()
  if url, ok := safeURLs[requestedKey]; ok {
      // continue with request
  } else {
      log.Fatal("Requested URL is not allowed")
  }

• Do implement IP safelists and blocklists to customize and block specific IP ranges, especially those that are private, loopback, or otherwise non-routable.
• Do use network-level security measures. If your HTTP client does not support IP range blocking, run it with restricted system permissions or within a network environment where firewall rules can effectively block requests to dangerous addresses.
• Do consider using a secure HTTP proxy to route all backend HTTP requests. This proxy can serve as a filter to block requests to potentially harmful addresses, acting as an additional layer of security.

References

• OWASP SSRF Prevention Cheat Sheet

Associated CWE

• CWE-918: Server-Side Request Forgery (SSRF)

OWASP Top 10

• A10:2021 - Server-side Request Forgery (SSRF)

Configuration

To skip this rule during a scan, use the following flag

bearer scan /path/to/your-project/ --skip-rule=go_gosec_injection_ssrf_injection

To run only this rule during a scan, use the following flag

bearer scan /path/to/your-project/ --only-rule=go_gosec_injection_ssrf_injection