Fix SSRF (Server Side Request Forgery) in Camping
SSRF in Camping occurs when the application processes user-supplied URLs to fetch remote resources without proper validation. In the context of a micro-framework like Camping, developers often use 'open-uri' or 'Net::HTTP' within controllers, creating a direct vector for attackers to probe internal network services, access cloud metadata (169.254.169.254), or bypass firewalls.
The Vulnerable Pattern
module App
class Preview < Camping::Controllers
def get
# CRITICAL: Directly passing user input to open-uri
# Attacker can pass url=http://127.0.0.1:6379 or url=file:///etc/passwd
@content = open(@input.url).read
render :index
end
end
endThe Secure Implementation
The fix implements a 'Verify-Then-Connect' pattern. First, it enforces a strict scheme whitelist (HTTP/HTTPS) to prevent 'file://' or 'gopher://' attacks. Second, it resolves the hostname to an IP address before the request is made. This IP is checked against private (RFC1918), loopback, and link-local ranges using the 'ipaddr' library. This prevents the application from being used as a proxy to hit internal databases or cloud provider metadata endpoints. Finally, it replaces the dangerous 'open-uri' wrapper with 'Net::HTTP' for more granular control over the request lifecycle.
require 'uri' require 'resolv' require 'ipaddr'module App class Preview < Camping::Controllers def get target_url = @input.url uri = URI.parse(target_url)
# 1. Protocol Whitelist raise "Invalid Protocol" unless ['http', 'https'].include?(uri.scheme) # 2. Prevent DNS Rebinding and Internal Access # Resolve IP and check against blacklisted ranges ip_address = Resolv.getaddress(uri.host) ip = IPAddr.new(ip_address) if ip.private? || ip.loopback? || ip.link_local? raise "Access Denied: Internal IP" end # 3. Use Net::HTTP with explicit URI to fetch response = Net::HTTP.get_response(uri) @content = response.body if response.is_a?(Net::HTTPSuccess) render :index rescue => e @content = "Error: #{e.message}" render :index end
end end
Your Camping API
might be exposed to SSRF (Server Side Request Forgery)
74% of Camping apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.
Free Tier • No Credit Card • Instant Report
Verified by Ghost Labs Security Team
This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.