VNX-918: Server-Side Request Forgery (SSRF)
Reports an outbound HTTP request in Python whose URL or host comes from the incoming request, inline, interpolated or through a variable. JavaScript/TypeScript is VNX-NODE-009; a fetch whose response is relayed back is VNX-441.
| Field | Value |
|---|---|
| Rule ID | VNX-918 |
| Severity | High |
| SARIF level | error |
| Kind | sast |
| Languages | Python |
| CWE | CWE-918 |
| CAPEC | CAPEC-66 |
| ATT&CK | T1190 |
| CWSS vector | CWSS:1.0/TI:H/AP:A/AL:A/IC:N/FC:LT/RP:N/RL:A/AV:I/AS:N/IN:A/SC:A/BI:H/DI:H/EX:H/EC:N/P:H |
| Tags | ssrf cwe-918 |
| Source | internal/sast/rules/vnx-918.rego |
Overview
The destination of a server-side HTTP request comes from the incoming request. Python: the URL argument of requests.*, httpx.* (including request(method, url) and stream(method, url)), methods on a requests.Session(), httpx.Client()/AsyncClient() or aiohttp.ClientSession() object in the same file, urllib.request.urlopen and urllib.request.Request. The URL must be request data inline, interpolated into the host, concatenated after a bare scheme, or carried by a variable assigned from it in the 20 lines above (one further assignment is followed).
Why This Matters
The server can reach places the client cannot: internal services, admin ports and the cloud metadata endpoint that hands out credentials.
What Gets Flagged
r = requests.post(request.POST.get("callback"), json={"done": True})
httpx.post(f"http://{host}/hook", json={"ok": True})
upstream = requests.request("HEAD", target, timeout=10)Not flagged: a URL whose host is fixed by a literal prefix or by an UPPER_CASE, settings.* or config.* base, request data passed only as query parameters, body or headers, a destination checked against an allow-list in the lines above, URLs from the environment or configuration, comments and strings.
Reported by other rules, so one request is one finding:
- JavaScript and TypeScript requests are reported by VNX-NODE-009, the Node.js form of this rule.
- A request whose response is then returned to the caller (
return r.content,HttpResponse(resp.read())) is reported by VNX-441: the service is an open proxy, the form of SSRF in which the attacker also reads what the server fetched.
Remediation
Fix the host on the server and take only a path or an identifier from the client. Where a client must name a destination, check its parsed host against an allow-list and refuse private, loopback and link-local addresses after resolution.
References
Suppressing this rule
Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):
# nosec vnx-918
// nosec vnx-918Or record an ignore rule: vulnetix ignore add --rule vnx-918 --reason "...". See Suppressing findings.