Description

Detects Server-Side Request Forgery (SSRF) vulnerabilities in Scala applications using the scalaj-http library. The vulnerability occurs when untrusted user input can control HTTP request URLs, potentially allowing attackers to make requests to internal systems or arbitrary external servers.

Detection Strategy

• Check if the scalaj.http library is imported in the source code

• Identify calls to Http constructor/methods with URL parameters

• Examine if the URL parameter comes from untrusted sources or user-controlled input

• Report a vulnerability when an Http request is made with a URL derived from tainted data

Vulnerable code example

package controllers

import play.api.mvc._
import scalaj.http.{Http, HttpResponse}
import scala.concurrent.Future

def makeRequest: Action[AnyContent] = Action.async { request =>
  // Vulnerable: Uses unvalidated user input as URL for HTTP request...

✅ Secure code example

package controllers

import play.api.mvc._
import scalaj.http.{Http, HttpResponse}
import scala.concurrent.Future

def makeRequest: Action[AnyContent] = Action.async { request =>
  val targetUrl = request.getQueryString("url").getOrElse("").trim...