Is it considered a SSRF vulnerability (or is it dangerous at all) if the backend of an application fetches a URL that is somewhat based off of user input, in a way similar to this

get("https://thehostname.com/a-directory/" + userinput)

So, because the hostname is hardcoded before the user input, it shouldn't be possible to scan the internal network or anything, right?

Without an open redirect vulnerability in https://thehostname.com/*, I don't see how you could pull anything off with that.

Edit: In the specific scenario that I am asking this question for, the server only responds with a true/false/error, indicating whether the content type of http response is a pdf, or if it failed to fetch the page (404, or host is down).

  • 1
    You should sanitize inputs. Process them into parameters and validate that they meet expected patterns. Primarily because you may not know what other behaviour will be added to the system later which may violate the assumptions you are making now. – nbering Aug 6 '18 at 18:28

As mentioned in the comments, always sanitize user input. Always assume the user may be malicious. While your snippet doesn't appear to be directly exploitable, you should also consider that not all URL parsers behave the same and the library you're using may affect what sort of exploitation you may be vulnerable to.

In a perfect world, you may be safe, but it's always good to do additional checks just to be sure. For example, if you only want users accessing certain pages, you should set up a white list. If they're not supposed to access subdirectories, make sure no slashes exist in the URL (encoded or otherwise).

  • Thank you! I ended up making a whitelist of alphanumeric chars and a few others, not including slashes or anything (normally that wouldn't be good since filenames can contain non-alphanumeric chars, but in this case, it should work fine). Thank you for the answer! – user149925 Aug 7 '18 at 20:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.