Description

Detects Server-Side Request Forgery (SSRF) vulnerabilities in Kotlin code where untrusted URLs are passed to HTTP clients. This occurs when user-controlled URLs are used in HTTP requests without proper validation, potentially allowing attackers to access internal resources or perform malicious network requests.

Detection Strategy

• Checks if code uses HTTP client libraries by looking for specific import statements

• Identifies HTTP client method calls that can make network requests (like .get(), .post(), etc.)

• Examines the URL parameter passed to these HTTP methods

• Reports a vulnerability if the URL comes from an untrusted source (like user input) without proper validation

Vulnerable code example

import io.ktor.server.application.*
import io.ktor.server.request.*
import org.springframework.web.client.RestTemplate

class SSRFVulnerableExample {
    private val INTERNAL_API = "http://internal-service/api/"

    suspend fun vulnerableEndpoint(call: ApplicationCall) {...

✅ Secure code example

import io.ktor.server.application.*
import io.ktor.server.request.*
import org.springframework.web.client.RestTemplate
import java.net.URL
import java.net.MalformedURLException

class SSRFSecureExample {
    private val INTERNAL_API = "http://internal-service/api/"...