Zennoxa Shield
Rules / Rust
SHIELD-RUST-011

SSRF via user-controlled request URL

highRustCWE-918CVSS 8.1

What it detects

Fetching a format!-built URL lets an attacker steer requests to internal hosts.

How to fix

Validate the URL against an allowlist of hosts and block private/link-local ranges.

Vulnerable — Shield flags thisstatus.rs
pub async fn fetch_health(host: &str) -> Result<String, reqwest::Error> {
    // `host` comes from a query parameter.
    let body = reqwest::get(&format!("https://{}/health", host))
        .await?
        .text()
        .await?;
    Ok(body)
}
Fixed — scans cleanstatus.rs
const ALLOWED_HOSTS: &[&str] = &["api.example.com", "status.example.com"];

pub async fn fetch_health(host: &str) -> Result<String, reqwest::Error> {
    if !ALLOWED_HOSTS.contains(&host) {
        panic!("host {} is not on the allowlist", host);
    }
    let url = format!("https://{}/health", host);
    Ok(reqwest::get(&url).await?.text().await?)
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-RUST-011, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-RUST-011: SSRF via user-controlled request URL — Zennoxa Shield