Description

Detects potential Server-Side Request Forgery (SSRF) vulnerabilities in Java applications using Apache HTTP Client. SSRF occurs when an application makes HTTP requests to arbitrary domains based on user input, which could allow attackers to probe internal networks or access sensitive resources.

Detection Strategy

• Check if the application imports Apache HTTP Client libraries (org.apache.http.*)

• Identify HTTP client method calls that create or execute requests

• Determine if the URL or URI parameters in these calls originate from untrusted sources like user input

• Flag instances where request destinations are not properly validated or restricted

Vulnerable code example

import org.apache.http.client.methods.HttpGet;
import org.apache.http.impl.client.CloseableHttpClient;
import jakarta.servlet.http.HttpServletRequest;

public class SSRFVulnerable {
    public void makeRequest(HttpServletRequest request, CloseableHttpClient client) {
        String url = request.getParameter("url");
        // VULNERABLE: User-controlled input directly used in HTTP request...

✅ Secure code example

import org.apache.http.client.methods.HttpGet;
import org.apache.http.impl.client.CloseableHttpClient;
import jakarta.servlet.http.HttpServletRequest;
import java.net.URL;
import java.util.Set;

public class SSRFSecure {
    // Define allowed hosts whitelist...