Skip to content
OpenAdvisories

Weakness (CWE)

CWE-918: Server-Side Request Forgery

Base Incomplete

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

How to prevent it (3 mitigations)

  1. Implementation, Operation

    If there is a known list of applications, IP, hostname, and/or domains to which the product is allowed to communicate, then use allowlists to ensure that outgoing requests are restricted to these known entities. The allowlists could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].

  2. Implementation, Operation

    If the product is expected to be able to connect to arbitrary IP addresses or domains, consider using a denylist that includes private network addresses, internal domain names, etc. The denylist could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].

  3. Implementation

    Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.

    When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."

    Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.

    When constructing outgoing requests from input strings, use stringent allowlists that limit the character set based on the expected value of the parameter in the request. This will indirectly limit the scope of an attack, but this technique is less important than proper output encoding and escaping.

Source: MITRE CWE-918

All Critical High Medium Low Exploited only Public exploit

1,873 results · Clear filters · Feed

  • Medium 5.9
    CVE-2024-33864

    An issue was discovered in linqi before 1.4.0.1 on Windows. There is SSRF via Document template generation; i.e., via r…

  • Medium 4.4
    CVE-2024-35172

    WordPress ShortPixel Adaptive Images plugin <= 3.8.3 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in ShortPixel ShortPixel Adaptive Images shortpixel-adaptive-images.This issue affects ShortPixel Adaptive Images: from n/a through <= 3.8.3.

    ShortPixel ShortPixel Adaptive Images
  • Medium 4.3
    CVE-2024-1467

    Starter Templates — Elementor, WordPress & Beaver Builder Templates <= 4.1.6 - Authenticated (Contributor+) Server-Side Request Forgery

    The Starter Templates — Elementor, WordPress & Beaver Builder Templates plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.1.6 via the ai_api_request(). This makes it possible for authenticated attackers,…

    Brainstorm Force Starter Templates – AI-Powered Templates for Elementor & Gutenberg Web / CMS
  • Medium 5.3
    CVE-2024-33117

    crmeb_java v1.3.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the mergeList method in class com.…

  • Medium 6.4
    CVE-2024-34068

    Server-side Request Forgery during remote file pull in Pterodactyl wings

    Pterodactyl wings is the server control plane for Pterodactyl Panel. An authenticated user who has access to a game server is able to bypass the previously implemented access control (GHSA-6rg3-8h8x-5xfv) that prevents accessing internal endpoints of the node…

    pterodactyl wings github.com/pterodactyl/wings Go
  • Medium 4.3
    CVE-2024-34453

    TwoNav 2.1.13 contains an SSRF vulnerability via the url paramater to index.php?c=api&method=read_data&type=connectivit…

  • Medium 5.0
    CVE-2024-23336

    Incomplete disallowed remote addresses list in MyBB

    MyBB is a free and open source forum software. The default list of disallowed remote hosts does not contain the `127.0.0.0/8` block, which may result in a Server-Side Request Forgery (SSRF) vulnerability. The Configuration File's _Disallowed Remote Addresses_…

    myBB Group mybb
  • Medium 6.4
    CVE-2024-0216

    Google Doc Embedder <= 2.6.4 - Authenticated (Contributor+) Blind Server Side Request Forgery

    The Google Doc Embedder plugin for WordPress is vulnerable to Server Side Request Forgery via the 'gview' shortcode in versions up to, and including, 2.6.4. This can allow authenticated attackers with contributor-level permissions or above to make web request…

    levertechadmin Google Doc Embedder Web / CMS
  • Medium 6.3
    CVE-2024-33832 Scanner template

    OneNav v0.9.35-20240318 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /index.php?c=a…

  • Medium 5.0
    CVE-2024-33590

    WordPress basepress plugin <= 2.16.1 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in codeSavory Knowledge Base documentation & wiki plugin – BasePress.This issue affects Knowledge Base documentation & wiki plugin – BasePress: from n/a through 2.16.1.

    codesavory Knowledge Base documentation & wiki plugin – BasePress
  • Medium 5.4
    CVE-2024-33634

    WordPress Piotnet Addons For Elementor Pro plugin <= 7.1.17 - Unauthenticated Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in Piotnet Piotnet Addons For Elementor Pro.This issue affects Piotnet Addons For Elementor Pro: from n/a through 7.1.17.

    Piotnet Piotnet Addons For Elementor Pro
  • Medium 4.4
    CVE-2024-33629

    WordPress Auto Featured Image (Auto Post Thumbnail) plugin <= 4.0.0 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in Creative Motion Auto Featured Image (Auto Post Thumbnail).This issue affects Auto Featured Image (Auto Post Thumbnail): from n/a through 4.0.0.

    Creative Motion Auto Featured Image (Auto Post Thumbnail)
  • Medium 4.4
    CVE-2024-33627

    WordPress AGCA – Custom Dashboard & Login Page plugin <= 7.2.2 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in Cusmin Absolutely Glamorous Custom Admin.This issue affects Absolutely Glamorous Custom Admin: from n/a through 7.2.2.

    Cusmin Absolutely Glamorous Custom Admin
  • Medium 5.4
    CVE-2024-33592

    WordPress Radio Player plugin <= 2.0.73 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in SoftLab Radio Player.This issue affects Radio Player: from n/a through 2.0.73.

    SoftLab Radio Player
  • Medium 4.9
    CVE-2024-32718

    WordPress The Pack Elementor addons plugin <= 2.0.8.2 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in Webangon The Pack Elementor.This issue affects The Pack Elementor addons: from n/a through 2.0.8.2.

    webangon The Pack Elementor addons
  • Medium 4.9
    CVE-2024-32775

    WordPress Embed Google Photos album plugin <= 2.1.9 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in Pavex Embed Google Photos album.This issue affects Embed Google Photos album: from n/a through 2.1.9.

    Pavex Embed Google Photos album
  • Medium 6.4
    CVE-2024-32803

    WordPress SuperFaktura WooCommerce plugin <= 1.40.3 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in 2day.Sk, Webikon SuperFaktura WooCommerce.This issue affects SuperFaktura WooCommerce: from n/a through 1.40.3.

    2day.sk, Webikon SuperFaktura WooCommerce Web / CMS
  • Medium 5.4
    CVE-2024-32812

    WordPress Podlove Podcast Publisher plugin <= 4.0.11 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in Podlove Podlove Podcast Publisher.This issue affects Podlove Podcast Publisher: from n/a through 4.0.11.

    Podlove Podlove Podcast Publisher
  • Medium 4.9
    CVE-2024-32819

    WordPress Culqi plugin <= 3.0.14 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in Culqi.This issue affects Culqi: from n/a through 3.0.14.

    Culqi Culqi
  • Medium 4.9
    CVE-2024-32955

    WordPress FV Flowplayer Video Player plugin <= 7.5.43.7212 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in Foliovision FV Flowplayer Video Player.This issue affects FV Flowplayer Video Player: from n/a through 7.5.43.7212.

    foliovision FV Flowplayer Video Player
  • Medium 5.3
    CVE-2024-27347

    Apache HugeGraph-Hubble: SSRF in Hubble connection page

    Server-Side Request Forgery (SSRF) vulnerability in Apache HugeGraph-Hubble.This issue affects Apache HugeGraph-Hubble: from 1.0.0 before 1.3.0. Users are recommended to upgrade to version 1.3.0, which fixes the issue.

    Apache Software Foundation Apache HugeGraph-Hubble org.apache.hugegraph:hugegraph-hubble Maven
  • Medium 6.2
    CVE-2024-31993

    Mealie vulnerable to a GET-based SSRF in recipe image importer (GHSL-2023-227)

    Mealie is a self hosted recipe manager and meal planner. Prior to 1.4.0, the scrape_image function will retrieve an image based on a user-provided URL, however the provided URL is not validated to point to an external location and does not have any enforced r…

    mealie-recipes mealie
  • Medium 4.1
    CVE-2024-31991

    Mealie vulnerable to a GET-based SSRF in recipe importer (GHSL-2023-225)

    Mealie is a self hosted recipe manager and meal planner. Prior to 1.4.0, the safe_scrape_html function utilizes a user-controlled URL to issue a request to a remote server. Based on the content of the response, it will either parse the content or disregard it…

    mealie-recipes mealie
  • Medium 6.1
    CVE-2024-29029 Scanner template

    memos vulnerable to an SSRF in /o/get/image

    memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /o/get/image that allows unauthenticated users to enumerate the internal network and retrieve images. The response from the image request is then c…

    usememos memos github.com/usememos/memos Go
  • Medium 5.8
    CVE-2024-29028 Scanner template

    memos vulnerable to an SSRF in /o/get/httpmeta

    memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /o/get/httpmeta that allows unauthenticated users to enumerate the internal network and receive limited html values in json form. This vulnerabilit…

    usememos memos github.com/usememos/memos Go
  • Medium 5.8
    CVE-2024-29030 Scanner template

    memos vulnerable to an SSRF in /api/resource

    memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /api/resource that allows authenticated users to enumerate the internal network. Version 0.22.0 of memos removes the vulnerable file.

    usememos memos github.com/usememos/memos Go
  • Medium 5.5
    CVE-2024-31229

    WordPress Really Simple SSL plugin <= 7.2.3 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in Really Simple Plugins Really Simple SSL.This issue affects Really Simple SSL: from n/a through 7.2.3.

    Really Simple Plugins Really Simple SSL
  • Medium 4.1
    CVE-2024-29035

    Umbraco's Blind SSRF Leads to Port Scan by using Webhooks

    Umbraco is an ASP.NET CMS. Failing webhooks logs are available when solution is not in debug mode. Those logs can contain information that is critical. This vulnerability is fixed in 13.1.1.

    umbraco Umbraco-CMS Umbraco.Cms.Web.BackOffice Umbraco.Cms.Core NuGet
  • Medium 6.4
    CVE-2023-6805

    RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 4.4.7 - Authenticated(Contributor+) Blind Server-Side Request Forgery (SSRF)

    The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 4.4.7 via the fetch_feed functionality. This makes i…

    themeisle RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator Web / CMS
  • Medium 4.3
    CVE-2024-22329

    IBM WebSphere Application Server server-side request forgery

    IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.3 are vulnerable to server-side request forgery (SSRF). By sending a specially crafted request, an attacker could exploit this vulnerability to cond…

    IBM WebSphere Application Server WebSphere Application Server - Liberty
  • Medium 6.4
    CVE-2024-30256

    Open WebUI vulnerable to server-side request forgery in utils.py

    Open WebUI is a user-friendly WebUI for LLMs. Open-webui is vulnerable to authenticated blind server-side request forgery. This vulnerability is fixed in 0.1.117.

    open-webui open-webui
  • Medium 4.4
    CVE-2024-32430

    WordPress ActiveCampaign plugin <= 8.1.14 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in ActiveCampaign.This issue affects ActiveCampaign: from n/a through 8.1.14.

    activecampaign ActiveCampaign
  • Medium 4.4
    CVE-2024-32454

    WordPress Wappointment plugin <= 2.6.0 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in Wappointment Appointment Bookings for Zoom GoogleMeet and more – Wappointment.This issue affects Appointment Bookings for Zoom GoogleMeet and more – Wappointment: from n/a through 2.6.0.

    Wappointment team Appointment Bookings for Zoom GoogleMeet and more – Wappointment
  • Medium 5.0
    CVE-2024-3448

    Improper Access Control Leads to Server-Side Request Forgery in Mautic

    Users with low privileges can perform certain AJAX actions. In this vulnerability instance, improper access to ajax?action=plugin:focus:checkIframeAvailability leads to a Server-Side Request Forgery by analyzing the error messages returned from the back-end. …

    Mautic Mautic
  • Medium 6.5
    CVE-2023-40148

    PingFederate Server Side Request Forgery vulnerability

    Server-side request forgery (SSRF) in PingFederate allows unauthenticated http requests to attack network resources and consume server-side resources via forged HTTP POST requests.

    Ping Identity PingFederate
  • Medium 6.4
    CVE-2024-2343

    Avada <= 7.11.6 - Authenticated (Contributor+) Server-Side Request Forgery via form_to_url_action

    The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.11.6 via the form_to_url_action function. This makes it possible for authenticated attackers, with…

    ThemeFusion Avada | Website Builder For WordPress & WooCommerce Web / CMS
  • Medium 5.3
    CVE-2024-27898

    Server-Side Request Forgery in SAP NetWeaver

    SAP NetWeaver application, due to insufficient input validation, allows an attacker to send a crafted request from a vulnerable web application targeting internal systems behind firewalls that are normally inaccessible to an attacker from the external network…

    SAP SAP NetWeaver
  • Medium 6.3
    CVE-2024-31215

    Mobile Security Framework (MobSF) vulnerable to Server-Side Request Forgery (SSRF) in firebase database check

    Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mobile. A SSRF vulnerability in firebase database check logic. The attacker can cause the server to make a connection to internal-only servic…

    MobSF Mobile-Security-Framework-MobSF mobsf PyPI
  • Medium 5.5
    CVE-2024-20332

    A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authentica…

    Cisco Cisco Identity Services Engine Software Network devices
  • Medium 4.9
    CVE-2024-30531

    WordPress Nelio Content plugin <= 3.2.0 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in Nelio Software Nelio Content.This issue affects Nelio Content: from n/a through 3.2.0.

    Nelio Software Nelio Content