Description

This vulnerability detector identifies potential Server-Side Request Forgery (SSRF) issues in Rust applications using the actix_web framework with reqwest or awc HTTP clients. SSRF vulnerabilities allow attackers to make requests from the server to internal or external resources, potentially accessing sensitive data or internal services.

Detection Strategy

• Scans Rust source code files for imports of both actix_web framework AND either reqwest or awc HTTP client libraries

• Identifies vulnerable client method calls that could enable SSRF attacks when user input controls the request destination

• Detects vulnerable free function calls from these HTTP libraries that may accept untrusted URLs

• Reports findings when HTTP client usage patterns indicate potential for server-side request forgery

Vulnerable code example

use actix_web::{web, HttpResponse};
use reqwest::Client;

async fn fetch_url(query: web::Query<std::collections::HashMap<String, String>>) -> HttpResponse {
    let target = query.get("target").unwrap();
    
    // VULNERABLE: user input directly interpolated into URL
    let url = format!("http://{}/status", target);...

✅ Secure code example

use actix_web::{web, HttpResponse};
use reqwest::Client;
use std::collections::HashSet;

fn validate_host(host: &str) -> Option<String> {
    let mut allowed_hosts = HashSet::new();
    allowed_hosts.insert("internal-service.local");
    allowed_hosts.insert("api.trusted.com");...