Description

This vulnerability detector identifies actix_web handlers that build a redis or mongodb connection string whose host comes from the HTTP request while the string also carries the application's own username and password. An attacker who controls the host makes the server dial a machine of their choosing and hand over those credentials, which can then be replayed against the real database.

Detection Strategy

• Analyzes only files that import the actix_web framework together with the redis or mongodb client

• Looks for connection calls to Client::open and Client::with_uri_str

• Inspects the connection string argument when it is built with the format! macro or with string concatenation, including the String::from and to_string wrappers around the static part

• Reports a vulnerability when request data supplies the entire host of the URL and the static part of that URL already contains a username and a password

• Does not report when the URL carries no credentials, when the userinfo has no password, or when the host is a fixed literal

• Does not report when the request data only reaches the port, path, query or fragment of the URL, or when it is validated before being used

Vulnerable code example

use actix_web::{get, web, HttpResponse};
use std::collections::HashMap;

#[get("/redis/connect")]
async fn connect(query: web::Query<HashMap<String, String>>) -> HttpResponse {
    let host = query.get("host").unwrap();

    // VULNERABLE: appuser/apppass are sent to a host the caller chooses...

✅ Secure code example

use actix_web::{get, HttpResponse};

#[get("/redis/connect")]
async fn connect() -> HttpResponse {
    // SAFE: the destination comes from server configuration, so the credentials
    // can only ever reach the intended database
    let host = std::env::var("REDIS_HOST").unwrap();
...