Zennoxa Shield
Rules / C#
SHIELD-CSHARP-014

SSRF via request from variable-controlled URL

highC#CWE-918CVSS 8.6

What it detects

An HTTP request target is built from a variable, allowing server-side request forgery to internal endpoints.

How to fix

Validate the URL host against an allowlist and reject internal or link-local addresses before making the request.

Vulnerable — Shield flags thisUrlPreviewController.cs
using System.Net;

public class UrlPreviewController : Controller
{
    public IActionResult Preview()
    {
        var target = Request.Query["url"];
        var request = WebRequest.Create(target); // SSRF: attacker controls the URL
        using var response = request.GetResponse();
        return Ok(new StreamReader(response.GetResponseStream()).ReadToEnd());
    }
}
Fixed — scans cleanUrlPreviewController.cs
using System.Net.Http;

public class UrlPreviewController : Controller
{
    private static readonly HashSet<string> AllowedHosts = new() { "api.example.com" };
    private static readonly HttpClient Client = new();

    public async Task<IActionResult> Preview()
    {
        var uri = new Uri(Request.Query["url"]);
        if (!AllowedHosts.Contains(uri.Host)) return BadRequest("host not allowed");
        return Ok(await Client.GetStringAsync(uri));
    }
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-CSHARP-014, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-CSHARP-014: SSRF via request from variable-controlled URL — Zennoxa Shield