Server-Side Request Forgery (SSRF)

ID

scala.ssrf.scala_ssrf_rule_ssrf

Severity

high

Remediation Complexity

medium

Remediation Risk

medium

Remediation Effort

medium

Resource

Ssrf

Language

Scala

Description

Server-Side Request Forgery occur when a web server executes a request to a user supplied destination parameter that is not validated. Such vulnerabilities could allow an attacker to access internal services or to launch attacks from your web server.

Rationale

Server-Side Request Forgery occur when a web server executes a request to a user supplied destination parameter that is not validated. Such vulnerabilities could allow an attacker to access internal services or to launch attacks from your web server.

The following code illustrates a vulnerable pattern detected by this rule:

object FeedFetcher {
  @throws[IOException]
  def byUrl(supplied: String): Unit = {
    // VULNERABLE: Server-Side Request Forgery (SSRF)
    new URL(supplied).openConnection.connect()
    // The host is fixed but the proxy is not, which reaches the same network.
    // VULNERABLE: Server-Side Request Forgery (SSRF)
    new URL("https://feeds.internal").openConnection(new Proxy(Proxy.Type.HTTP, new InetSocketAddress(supplied, 8080))).connect()
    // VULNERABLE: Server-Side Request Forgery (SSRF)
    new URL(supplied).openConnection.getInputStream()
    // VULNERABLE: Server-Side Request Forgery (SSRF)
    new URL(supplied).openConnection.getLastModified()
    // VULNERABLE: Server-Side Request Forgery (SSRF)
    new URL(supplied).openStream()
    // VULNERABLE: Server-Side Request Forgery (SSRF)
    new URL(supplied).getContent()
    // VULNERABLE: Server-Side Request Forgery (SSRF)
    new URL(supplied).getContent(new Array(0))
  }

  @throws[IOException]
  @throws[URISyntaxException]
}

Remediation

Follow secure coding practices and review the references below for detailed remediation guidance.

Configuration

This detector does not need any configuration.

References

© 2026 Xygeni. All rights reserved