mcp-server-semgrep/semgrep-rules/csharp/lang/security/ssrf/web-request.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: ssrf
  severity: ERROR
  languages:
  - csharp
  metadata:
    cwe:
    - 'CWE-918: Server-Side Request Forgery (SSRF)'
    owasp:
    - A10:2021 - Server-Side Request Forgery (SSRF)
    references:
    - https://cwe.mitre.org/data/definitions/918.html
    - https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html
    category: security
    technology:
    - .net
    confidence: LOW
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
  message: >-
    The web server receives a URL or similar request from an upstream component and retrieves the contents
    of this URL, but
    it does not sufficiently ensure that the request is being sent to the expected destination.
    Many different options exist to fix this issue depending the use case (Application can send request
    only to identified
    and trusted applications, Application can send requests to ANY external IP address or domain name).
  patterns:
  - pattern-inside: |
      using System.Net;
      ...
  - pattern-either:
    - pattern: |
        $T $F(..., $X, ...)
        {
        ...
        ... WebRequest.Create(<... $X ...>);
        }
    - pattern: |
        $T $F($X)
        {
        ...
        $A $B = <... $X ...>;
        ...
        ... WebRequest.Create($B);
        }
    - pattern: |
        $T $F($X)
        {
        ...
        $A $B = <... $X ...>;
        ...
        $C $D = <... $B ...>;
        ...
        ... WebRequest.Create($D);
        }