contrib.nodejsscan.ssrf_wkhtmltoimage.wkhtmltoimage_ssrf

profile photo of returntocorpreturntocorp
Author
99
Download Count*
GPLv3
License

User controlled URL reached to wkhtmltoimage can result in Server Side Request Forgery (SSRF).

Run Locally

Run in CI

Semgrep CI docs

Defintion

Edit RuleView Source
Open in Playground 
rules:
  - id: wkhtmltoimage_ssrf
    patterns:
      - pattern-inside: |
          require('wkhtmltoimage');
          ...
      - pattern-either:
          - pattern-inside: function ($REQ, $RES, ...) {...}
          - pattern-inside: function $FUNC($REQ, $RES, ...) {...}
          - pattern-inside: $X = function $FUNC($REQ, $RES, ...) {...}
          - pattern-inside: var $X = function $FUNC($REQ, $RES, ...) {...};
          - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, ...) {...})
      - pattern-either:
          - pattern: |
              $INP = <... $REQ.$VAR ...>;
              ...
              $PKG.generate(<... $INP ...>, ...);
          - pattern: |
              $INP = <... $REQ.$VAR.$FOO ...>;
              ...
              $PKG.generate(<... $INP ...>, ...);
          - pattern: |
              $PKG.generate(<... $REQ.$VAR ...>, ...)
          - pattern: |
              $PKG.generate(<... $REQ.$VAR.$FOO ...>, ...)
    message: User controlled URL reached to `wkhtmltoimage` can result in Server
      Side Request Forgery (SSRF).
    languages:
      - javascript
    severity: ERROR
    metadata:
      owasp: A01:2017 - Injection
      cwe: "CWE-918: Server-Side Request Forgery (SSRF)"
      category: security
      technology:
        - node.js
        - express
      license: Commons Clause License Condition v1.0[LGPL-2.1-only]

Examples

ssrf_wkhtmltoimage.js

var wkhtmltoimage = require('wkhtmltoimage')

// ok: wkhtmltoimage_ssrf
wkhtmltoimage.generate(input(), { output: 'vuln.jpg' })

function test(userInput) {
    // ok: wkhtmltoimage_ssrf
    wkhtmltoimage.generate(userInput, { output: 'vuln.jpg' })
}


app.get('/', function (req, res) {

    // ruleid:wkhtmltoimage_ssrf
    wkhtmltoimage.generate(req.foo, { output: 'vuln.jpg' })


});