Weakness (CWE)
CWE-918: Server-Side Request Forgery
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
How to prevent it (3 mitigations)
-
Implementation, Operation
If there is a known list of applications, IP, hostname, and/or domains to which the product is allowed to communicate, then use allowlists to ensure that outgoing requests are restricted to these known entities. The allowlists could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].
-
Implementation, Operation
If the product is expected to be able to connect to arbitrary IP addresses or domains, consider using a denylist that includes private network addresses, internal domain names, etc. The denylist could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].
-
Implementation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
When constructing outgoing requests from input strings, use stringent allowlists that limit the character set based on the expected value of the parameter in the request. This will indirectly limit the scope of an attack, but this technique is less important than proper output encoding and escaping.
Source: MITRE CWE-918
1,406 results · Clear filters · Feed
-
High 8.1
ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Server-Side Request Forgery (SSRF). The document editor servi…
-
High 8.8CVE-2022-45926 EPSS 17%
An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). The endpoint notify.localizeEmailTempla…
-
High 8.8CVE-2023-22493 Public exploit
RSSHub is vulnerable to SSRF (Server-Side Request Forgery)
RSSHub is an open source RSS feed generator. RSSHub is vulnerable to Server-Side Request Forgery (SSRF) attacks. This vulnerability allows an attacker to send arbitrary HTTP requests from the server to other servers or resources on the network. An attacker ca…
-
High 7.5CVE-2022-25026 EPSS 24%
A Server-Side Request Forgery (SSRF) in Rocket TRUfusion Portal v7.9.2.1 allows remote attackers to gain access to sens…
-
High 7.8
RHACM: unauthenticated SSRF in console API endpoint. A Server-Side Request Forgery (SSRF) vulnerability was found in th…
-
High 7.5
Microsoft Exchange Server Information Disclosure Vulnerability
Microsoft Exchange Server Information Disclosure Vulnerability
-
High 7.5
Server Side Request Forgery (SSRF) vulnerability in Portal for ArcGIS (10.9.1, 10.8.1 and 10.7.1 only)
Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.9.1 and below were not fully honored and may allow a remote, unauthenticated attacker to forge requests to arbitrary URLs from the system, p…
-
High 7.5
The allowedProxyHosts property is not fully honored in ArcGIS Enterprise (10.8.1 and 10.7.1 only)
Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.8.1 and below were not fully honored and may allow a remote, unauthenticated attacker to forge requests to arbitrary URLs from the system, p…
-
High 7.5
Server Side Request Forgery (SSRF) vulnerability in Portal for ArcGIS (10.8.1 and 10.7.1 only)
Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.8.1 and below were not fully honored and may allow a remote, unauthenticated attacker to forge requests to arbitrary URLs from the system, p…
-
High 7.2CVE-2022-23544 Scanner template
Server-Side Request Forgery in Metersphere leads to Cross-Site Scripting
MeterSphere is a one-stop open source continuous testing platform, covering test management, interface testing, UI testing and performance testing. Versions prior to 2.5.0 are subject to a Server-Side Request Forgery that leads to Cross-Site Scripting. A Serv…
-
High 7.5
Some Dahua software products have a vulnerability of server-side request forgery (SSRF). An Attacker can access interna…
-
High 8.6CVE-2022-41412 Scanner template
An issue in the graphData.cgi component of perfSONAR v4.4.5 and prior allows attackers to access sensitive data and exe…
-
High 8.8CVE-2022-4096 Public exploit
Server-Side Request Forgery (SSRF) in appsmithorg/appsmith
Server-Side Request Forgery (SSRF) in GitHub repository appsmithorg/appsmith prior to 1.8.2.
-
High 7.5
A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). An unauthenticated Server-Side Reque…
-
High 7.5CVE-2022-43140 Scanner template
kkFileView v4.1.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component cn.keking.web.contro…
-
High 8.8
XXL-JOB vulnerable to Server-Side Request Forgery (SSRF)
XXL-Job before v2.3.1 contains a Server-Side Request Forgery (SSRF) via the component /admin/controller/JobLogController.java.
-
High 7.7
OpenSearch Notifications is vulnerable to Server-Side Request Forgery (SSRF)
OpenSearch Notifications is a notifications plugin for OpenSearch that enables other plugins to send notifications via Email, Slack, Amazon Chime, Custom web-hook etc channels. A potential SSRF issue in OpenSearch Notifications Plugin starting in 2.0.0 and pr…
-
High 7.7
A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot application could allow an authenti…
-
High 7.6
Possible Server-Side Request Forgery (SSRF) in webhooks
Discourse is a platform for community discussion. A malicious admin could use this vulnerability to perform port enumeration on the local host or other hosts on the internal network, as well as against hosts on the Internet. Latest `stable`, `beta`, and `test…
-
High 8.8
A vulnerability in the MiCollab Client server component of Mitel MiCollab through 9.5.0.101 could allow an authenticate…
-
High 7.5
Apache Batik prior to 1.16 allows RCE when loading untrusted SVG input
A vulnerability in Batik of Apache XML Graphics allows an attacker to run untrusted Java code from an SVG. This issue affects Apache XML Graphics prior to 1.16. It is recommended to update to version 1.16.
-
High 7.5
Apache Batik prior to 1.16 allows RCE via scripting
A vulnerability in Batik of Apache XML Graphics allows an attacker to run Java code from untrusted SVG via JavaScript. This issue affects Apache XML Graphics prior to 1.16. Users are recommended to upgrade to version 1.16.
-
High 8.8
Microsoft Exchange Server Elevation of Privilege Vulnerability
Microsoft Exchange Server Elevation of Privilege Vulnerability
KEV Sep 30, 2022 -
High 7.2
Post SMTP < 2.1.7 - Admin+ Blind SSRF
The Post SMTP Mailer/Email Log WordPress plugin before 2.1.7 does not have proper authorisation in some AJAX actions, which could allow high privilege users such as admin to perform blind SSRF on multisite installations for example.
-
High 7.5CVE-2022-40146 Public exploit
Jar url should be blocked by DefaultScriptSecurity
Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to access files using a Jar url. This issue affects Apache XML Graphics Batik 1.14.
-
High 8.8
A Server-Side Request Forgery (SSRF) in fetch_net_file_upload function of baijiacmsV4 v4.1.4 allows remote attackers to…
-
High 7.1
TIBCO Spotfire Server Blind SSRF vulnerability
The Web Player component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains a difficult to exploit vulnerability that allows a low privileged attacker with network access to execute blind Server S…
-
High 7.6
Server-Side Request Forgery (SSRF) vulnerability in Databasir
Databasir is a database metadata management platform. Databasir <= 1.06 has Server-Side Request Forgery (SSRF) vulnerability. The SSRF is triggered by a sending a **single** HTTP POST request to create a databaseType. By supplying a `jdbcDriverFileUrl` that r…
-
High 7.5
Prevent access to sharing/rest/content/features/analyze to unauthorized users
Prior to version 10.9.0, the sharing/rest/content/features/analyze endpoint is always accessible to anonymous users, which could allow an unauthenticated attacker to induce Esri Portal for ArcGIS to read arbitrary URLs.
-
High 7.5
4thline cling uPnP protocol issue can lead to denial of service
An issue in the UPnP protocol in 4thline cling 2.0.0 through 2.1.2 allows remote attackers to cause a denial of service via an unchecked CALLBACK parameter in the request header
-
High 7.1CVE-2022-2756 Scanner template
Server-Side Request Forgery (SSRF) in kareadita/kavita
Server-Side Request Forgery (SSRF) in GitHub repository kareadita/kavita prior to 0.5.4.1.
-
High 8.3
Unauthenticated SSRF in 3rd party module "cerdic/csstidy"
Nextcloud Mail is an email application for the nextcloud personal cloud product. Affected versions shipped with a CSS minifier on the path `./vendor/cerdic/css-tidy/css_optimiser.php`. Access to the minifier is unrestricted and access may lead to Server-Side …
-
High 8.6
Server-Side Request Forgery Vulnerability in Computer Vision Annotation Tool (CVAT)
CVAT is an opensource interactive video and image annotation tool for computer vision. Versions prior to 2.0.0 were found to be subject to a Server-side request forgery (SSRF) vulnerability. Validation has been added to urls used in the affected code path in …
-
High 7.5
Server-Side Request Forgery in Jodd HTTP
Jodd HTTP v6.0.9 was discovered to contain multiple CLRF injection vulnerabilities via the components jodd.http.HttpRequest#set and `jodd.http.HttpRequest#send. These vulnerabilities allow attackers to execute Server-Side Request Forgery (SSRF) via a crafted …
-
High 8.3
Server-Side Request Forgery (SSRF) in gogs/gogs
Server-Side Request Forgery (SSRF) in GitHub repository gogs/gogs prior to 0.12.8.
-
High 7.5
Server-Side Request Forgery (SSRF) in jgraph/drawio
Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.8.
-
High 7.5
Server-Side Request Forgery (SSRF) in jgraph/drawio
Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.7.
-
High 7.5CVE-2022-1711 Scanner template
Server-Side Request Forgery (SSRF) in jgraph/drawio
Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.5.
-
High 7.5
Server-Side Request Forgery (SSRF) in jgraph/drawio
Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.6.
-
High 7.5CVE-2022-1713 Scanner template
SSRF on /proxy in jgraph/drawio
SSRF on /proxy in GitHub repository jgraph/drawio prior to 18.0.4. An attacker can make a request as the server and read its contents. This can lead to a leak of sensitive information.