fix Server-side request forgery on WebProxyServer()

[odaysec]

elasticsearch/modules/repository-gcs/src/internalClusterTest/java/org/elasticsearch/repositories/gcs/WebProxyServer.java

Line 54 in c72d00f

upstreamRequest.setURI(URI.create(request.getRequestLine().getUri()));

fix the SSRF vulnerability will validate the URI extracted from the incoming request. Specifically:

1. Introduce a whitelist of allowed hosts or URI prefixes that the proxy server can forward requests to.
2. Before creating the URI object, check if the incoming URI matches the allowed hosts or prefixes. If it does not, reject the request by setting an appropriate error response.
3. This ensures that the proxy server only forwards requests to trusted destinations, mitigating the SSRF risk.

Directly incorporating user input into an HTTP request without validating the input can facilitate server-side request forgery (SSRF) attacks. In these attacks, the server may be tricked into making a request and interacting with an attacker-controlled server.

POC

The following shows an HTTP request parameter being used directly to form a new request without validating the input, which facilitates SSRF attacks. It also shows how to remedy the problem by validating the user input against a known fixed string.

import java.net.http.HttpClient;

public class SSRF extends HttpServlet {
	private static final String VALID_URI = "http://lgtm.com";
	private HttpClient client = HttpClient.newHttpClient();

	protected void doGet(HttpServletRequest request, HttpServletResponse response)
		throws ServletException, IOException {
		URI uri = new URI(request.getParameter("uri"));
		// BAD: a request parameter is incorporated without validation into a Http request
		HttpRequest r = HttpRequest.newBuilder(uri).build();
		client.send(r, null);

		// GOOD: the request parameter is validated against a known fixed string
		if (VALID_URI.equals(request.getParameter("uri"))) {
			HttpRequest r2 = HttpRequest.newBuilder(uri).build();
			client.send(r2, null);
		}
	}
}

References

OWASP SSRF
CWE-918

[DaveCTurner]

This is a private test-only class that only listens on localhost on a CI test runner. If you can talk to it, you're already on the other side of the airtight hatchway.