CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
4785 vulnerabilities reference this CWE, most recent first.
GHSA-FPJQ-WFVR-WX93
Vulnerability from github – Published: 2024-06-21 00:33 – Updated: 2025-08-27 21:31A Server-Side Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed an attacker with the Site Administrator role to gain arbitrary code execution capability on the GitHub Enterprise Server instance. Exploitation required authenticated access to GitHub Enterprise Server as a user with the Site Administrator role. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.13 and was fixed in versions 3.12.5, 3.11.11, 3.10.13, and 3.9.16. This vulnerability was reported via the GitHub Bug Bounty program.
{
"affected": [],
"aliases": [
"CVE-2024-5746"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-20T22:15:16Z",
"severity": "HIGH"
},
"details": "A Server-Side Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed an attacker with the Site Administrator role to gain arbitrary code execution capability on the GitHub Enterprise Server instance. Exploitation required authenticated access to GitHub Enterprise Server as a user with the Site Administrator role.\u00a0This vulnerability affected all versions of GitHub Enterprise Server prior to 3.13 and was fixed in versions 3.12.5, 3.11.11, 3.10.13, and 3.9.16. This vulnerability was reported via the GitHub Bug Bounty program.",
"id": "GHSA-fpjq-wfvr-wx93",
"modified": "2025-08-27T21:31:37Z",
"published": "2024-06-21T00:33:10Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5746"
},
{
"type": "WEB",
"url": "https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.13"
},
{
"type": "WEB",
"url": "https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.11"
},
{
"type": "WEB",
"url": "https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.5"
},
{
"type": "WEB",
"url": "https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.16"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-FPM8-6XJP-2HQ8
Vulnerability from github – Published: 2026-06-26 15:32 – Updated: 2026-06-26 15:32HTMLy 3.1.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the RSS feed import functionality. The function get_feed() in system/admin/admin.php passes user-supplied $feed_url directly to file_get_contents() without any validation. An authenticated attacker with administrative privileges can exploit this by entering a crafted URL (e.g., http://dnslog.example.com, file:///etc/passwd, or http://169.254.169.254 in cloud contexts) via Tools -> Import RSS. The server will then make a request to the attacker-controlled target.
{
"affected": [],
"aliases": [
"CVE-2026-57940"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-26T14:17:07Z",
"severity": "LOW"
},
"details": "HTMLy 3.1.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the RSS feed import functionality. The function get_feed() in system/admin/admin.php passes user-supplied $feed_url directly to file_get_contents() without any validation. An authenticated attacker with administrative privileges can exploit this by entering a crafted URL (e.g., http://dnslog.example.com, file:///etc/passwd, or http://169.254.169.254 in cloud contexts) via Tools -\u003e Import RSS. The server will then make a request to the attacker-controlled target.",
"id": "GHSA-fpm8-6xjp-2hq8",
"modified": "2026-06-26T15:32:14Z",
"published": "2026-06-26T15:32:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57940"
},
{
"type": "WEB",
"url": "https://github.com/danpros/htmly/blob/c8b7ed9af39a266b256759becf26dba6a59e11e6/system/admin/admin.php#L1549-L1551"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:D/RE:L/U:Clear",
"type": "CVSS_V4"
}
]
}
GHSA-FPW6-P57H-MV5Q
Vulnerability from github – Published: 2026-04-05 06:32 – Updated: 2026-04-05 06:32A vulnerability was detected in QingdaoU OnlineJudge up to 1.6.1. Affected by this issue is the function service_url of the file JudgeServer.service_url of the component judge_server_heartbeat Endpoint. The manipulation results in server-side request forgery. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2026-5538"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-05T04:16:15Z",
"severity": "MODERATE"
},
"details": "A vulnerability was detected in QingdaoU OnlineJudge up to 1.6.1. Affected by this issue is the function service_url of the file JudgeServer.service_url of the component judge_server_heartbeat Endpoint. The manipulation results in server-side request forgery. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-fpw6-p57h-mv5q",
"modified": "2026-04-05T06:32:02Z",
"published": "2026-04-05T06:32:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5538"
},
{
"type": "WEB",
"url": "https://github.com/AnalogyC0de/public_exp/issues/27"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/782203"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/355291"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/355291/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-FPX8-73GF-7X73
Vulnerability from github – Published: 2026-03-05 21:43 – Updated: 2026-03-09 13:12Summary
The webhook URL validation in plane/app/serializers/webhook.py only checks ip.is_loopback, allowing attackers with workspace ADMIN role to create webhooks pointing to private/internal network addresses (10.x.x.x, 172.16.x.x, 192.168.x.x, 169.254.169.254, etc.). When webhook events fire, the server makes requests to these internal addresses and stores the response — enabling SSRF with full response read-back.
Impact
- Cloud metadata exfiltration: Access AWS/GCP/Azure instance metadata (IAM credentials, tokens)
- Internal service scanning: Probe internal network services not exposed to the internet
- Data exfiltration via response logs: Full response body from internal services is stored and returned to the attacker through the webhook logs API
- Bypass vectors:
10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,169.254.0.0/16,0.0.0.0,::ffff:mapped addresses
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.2.1"
},
"package": {
"ecosystem": "PyPI",
"name": "plane"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-30242"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-05T21:43:15Z",
"nvd_published_at": "2026-03-06T22:16:01Z",
"severity": "HIGH"
},
"details": "### Summary\nThe webhook URL validation in `plane/app/serializers/webhook.py` only checks `ip.is_loopback`, allowing attackers with workspace ADMIN role to create webhooks pointing to private/internal network addresses (`10.x.x.x`, `172.16.x.x`, `192.168.x.x`, `169.254.169.254`, etc.). When webhook events fire, the server makes requests to these internal addresses and stores the response \u2014 enabling SSRF with full response read-back.\n\n### Impact\n- **Cloud metadata exfiltration**: Access AWS/GCP/Azure instance metadata (IAM credentials, tokens)\n- **Internal service scanning**: Probe internal network services not exposed to the internet\n- **Data exfiltration via response logs**: Full response body from internal services is stored and returned to the attacker through the webhook logs API\n- Bypass vectors: `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`, `169.254.0.0/16`, `0.0.0.0`, `::ffff:` mapped addresses",
"id": "GHSA-fpx8-73gf-7x73",
"modified": "2026-03-09T13:12:11Z",
"published": "2026-03-05T21:43:15Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/makeplane/plane/security/advisories/GHSA-fpx8-73gf-7x73"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30242"
},
{
"type": "PACKAGE",
"url": "https://github.com/makeplane/plane"
},
{
"type": "WEB",
"url": "https://github.com/makeplane/plane/releases/tag/v1.2.3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Plane has SSRF via Incomplete IP Validation in Webhook URL Serializer"
}
GHSA-FPX9-9HQ8-W2XC
Vulnerability from github – Published: 2026-04-14 18:30 – Updated: 2026-04-16 01:32A Server-Side Request Forgery (SSRF) in the /settings/webhooks/create component of Webkul Krayin CRM v2.2.x allows attackers to scan internal resources via supplying a crafted POST request.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "krayin/laravel-crm"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.2.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-38527"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-16T01:32:29Z",
"nvd_published_at": "2026-04-14T16:16:43Z",
"severity": "HIGH"
},
"details": "A Server-Side Request Forgery (SSRF) in the /settings/webhooks/create component of Webkul Krayin CRM v2.2.x allows attackers to scan internal resources via supplying a crafted POST request.",
"id": "GHSA-fpx9-9hq8-w2xc",
"modified": "2026-04-16T01:32:29Z",
"published": "2026-04-14T18:30:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-38527"
},
{
"type": "WEB",
"url": "https://github.com/TREXNEGRO/Security-Advisories/tree/main/CVE-2026-38527"
},
{
"type": "PACKAGE",
"url": "https://github.com/krayin/laravel-crm"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Webkul Krayin CRM has Server-Side Request Forgery (SSRF)"
}
GHSA-FQ6M-725P-M7WR
Vulnerability from github – Published: 2022-05-05 00:00 – Updated: 2022-05-13 00:01Jspxcms v10.2.0 allows attackers to execute a Server-Side Request Forgery (SSRF) via /cmscp/ext/collect/fetch_url.do?url=.
{
"affected": [],
"aliases": [
"CVE-2022-28090"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-05-04T14:15:00Z",
"severity": "MODERATE"
},
"details": "Jspxcms v10.2.0 allows attackers to execute a Server-Side Request Forgery (SSRF) via /cmscp/ext/collect/fetch_url.do?url=.",
"id": "GHSA-fq6m-725p-m7wr",
"modified": "2022-05-13T00:01:10Z",
"published": "2022-05-05T00:00:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28090"
},
{
"type": "WEB",
"url": "https://gitee.com/jspxcms/Jspxcms/issues/I4ZKDR"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-FQ78-33G3-P22Q
Vulnerability from github – Published: 2022-05-24 17:44 – Updated: 2022-05-24 17:44IBM Planning Analytics 2.0 could be vulnerable to a Server-Side Request Forgery (SSRF) attack by constucting URLs from user-controlled data . This could enable attackers to make arbitrary requests to the internal network or to the local file system. IBM X-Force ID: 190852.
{
"affected": [],
"aliases": [
"CVE-2020-4882"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-03-22T17:15:00Z",
"severity": "MODERATE"
},
"details": "IBM Planning Analytics 2.0 could be vulnerable to a Server-Side Request Forgery (SSRF) attack by constucting URLs from user-controlled data . This could enable attackers to make arbitrary requests to the internal network or to the local file system. IBM X-Force ID: 190852.",
"id": "GHSA-fq78-33g3-p22q",
"modified": "2022-05-24T17:44:59Z",
"published": "2022-05-24T17:44:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-4882"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/190852"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/6430643"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-FQFJ-CMH6-HJ49
Vulnerability from github – Published: 2019-06-13 16:15 – Updated: 2023-07-05 19:06Ruby OpenID (aka ruby-openid) through 2.8.0 is vulnerable to SSRF. Ruby-openid performs discovery first, and then verification. This allows an attacker to change the URL used for discovery and trick the server into connecting to the URL, which might be a private server not publicly accessible. Severity can range from medium to critical, depending on how a web application developer chose to employ the ruby-openid library. Developers who based their OpenID integration heavily on the "example app" provided by the project are at highest risk.
{
"affected": [
{
"package": {
"ecosystem": "RubyGems",
"name": "ruby-openid"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.9.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2019-11027"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2019-06-13T15:45:16Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "Ruby OpenID (aka ruby-openid) through 2.8.0 is vulnerable to SSRF. Ruby-openid performs discovery first, and then verification. This allows an attacker to change the URL used for discovery and trick the server into connecting to the URL, which might be a private server not publicly accessible. Severity can range from medium to critical, depending on how a web application developer chose to employ the ruby-openid library. Developers who based their OpenID integration heavily on the \"example app\" provided by the project are at highest risk.",
"id": "GHSA-fqfj-cmh6-hj49",
"modified": "2023-07-05T19:06:46Z",
"published": "2019-06-13T16:15:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11027"
},
{
"type": "WEB",
"url": "https://github.com/openid/ruby-openid/issues/122"
},
{
"type": "WEB",
"url": "https://github.com/openid/ruby-openid/commit/d181a8a2099c64365a1d24b29f6b6b646673a131"
},
{
"type": "PACKAGE",
"url": "https://github.com/openid/ruby-openid"
},
{
"type": "WEB",
"url": "https://github.com/openid/ruby-openid/releases/tag/v2.9.0"
},
{
"type": "WEB",
"url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/ruby-openid/CVE-2019-11027.yml"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2019/10/msg00014.html"
},
{
"type": "WEB",
"url": "https://marc.info/?l=openid-security\u0026m=155154717027534\u0026w=2"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202003-09"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "ruby-openid SSRF via claimed_id request"
}
GHSA-FQGF-87C4-QVQM
Vulnerability from github – Published: 2023-06-20 09:30 – Updated: 2024-01-12 09:30IPv4-mapped IPv6 addresses did not get recognized as "local" by the code and a connection attempt is made. Attackers with access to user accounts could use this to bypass existing deny-list functionality and trigger requests to restricted network infrastructure to gain insight about topology and running services. We now respect possible IPV4-mapped IPv6 addresses when checking if contained in a deny-list. No publicly available exploits are known.
{
"affected": [],
"aliases": [
"CVE-2023-26431"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-06-20T08:15:09Z",
"severity": "MODERATE"
},
"details": "IPv4-mapped IPv6 addresses did not get recognized as \"local\" by the code and a connection attempt is made. Attackers with access to user accounts could use this to bypass existing deny-list functionality and trigger requests to restricted network infrastructure to gain insight about topology and running services. We now respect possible IPV4-mapped IPv6 addresses when checking if contained in a deny-list. No publicly available exploits are known.\n\n",
"id": "GHSA-fqgf-87c4-qvqm",
"modified": "2024-01-12T09:30:25Z",
"published": "2023-06-20T09:30:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26431"
},
{
"type": "WEB",
"url": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0002.json"
},
{
"type": "WEB",
"url": "https://documentation.open-xchange.com/security/advisories/csaf/oxas-adv-2023-0002.json"
},
{
"type": "WEB",
"url": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6219_7.10.6_2023-03-20.pdf"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/173083/OX-App-Suite-SSRF-Resource-Consumption-Command-Injection.html"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2023/Jun/8"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-FQH4-X256-62FM
Vulnerability from github – Published: 2022-05-24 17:09 – Updated: 2022-05-24 17:09OX App Suite through 7.10.2 allows SSRF.
{
"affected": [],
"aliases": [
"CVE-2019-18846"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-02-21T21:15:00Z",
"severity": "MODERATE"
},
"details": "OX App Suite through 7.10.2 allows SSRF.",
"id": "GHSA-fqh4-x256-62fm",
"modified": "2022-05-24T17:09:26Z",
"published": "2022-05-24T17:09:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-18846"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/156474/Open-Xchange-App-Suite-Documents-Server-Side-Request-Forgery.html"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/158070/OX-App-Suite-OX-Documents-7.10.3-XSS-SSRF-Improper-Validation.html"
}
],
"schema_version": "1.4.0",
"severity": []
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.