CWE-918

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@portkey-ai/gateway"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.14.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-66405"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-12-02T01:08:37Z",
    "nvd_published_at": "2025-12-01T23:15:53Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\nThe gateway determines the destination baseURL by prioritizing the value in the x-portkey-custom-host request header. The proxy route then appends the client-specified path to perform an external fetch. This can be maliciously used by users for SSRF (CWE-918) attack\n\n### Impact\nThis vulnerability can be exploited to force the server to make requests to arbitrary hosts on the internal network. This could allow an attacker to exfiltrate sensitive data, for instance, by accessing the AWS metadata service.\n\n### Patches\nThe issue is patched in 1.14.0 (https://github.com/Portkey-AI/gateway/pull/1372)\n\nThe vulnerability resides within the gateway\u0027s request processing function which handles the `x-portkey-custom-host` header. This parameter was passed directly or with insufficient validation/sanitization to an internal HTTP request function.\n\n**The fix (v1.14.0) implements a robust allow-list policy:**\n\n1. All custom host inputs are now strictly validated to ensure the resulting URI points only to trusted, expected external services.\n\n2. The implementation now explicitly blocks requests to non-routable IP addresses, loopback addresses, private networks and standard metadata endpoints.\n\n### Credit\nThis vulnerability was discovered and reported responsibly by @im-soohyun. We thank them for their adherence to coordinated vulnerability disclosure principles.\n\n### References\nhttps://cwe.mitre.org/data/definitions/918.html",
  "id": "GHSA-hhh5-2cvx-vmfp",
  "modified": "2025-12-02T01:08:38Z",
  "published": "2025-12-02T01:08:37Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Portkey-AI/gateway/security/advisories/GHSA-hhh5-2cvx-vmfp"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66405"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Portkey-AI/gateway/pull/1372"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Portkey-AI/gateway/commit/b5a7825ba5f4e6918deb32d9969899ce2229a885"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Portkey-AI/gateway"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Portkey.ai Gateway: Server-Side Request Forgery (SSRF) in Custom Host"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "remdex/livehelperchat"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.67"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-1213"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-04-07T15:44:18Z",
    "nvd_published_at": "2022-04-05T04:15:00Z",
    "severity": "HIGH"
  },
  "details": "SSRF filter bypass port 80, 433 in LiveHelperChat prior to v3.67. An attacker could make the application perform arbitrary requests, bypass CVE-2022-1191",
  "id": "GHSA-hhr9-7xvh-8xgc",
  "modified": "2022-04-19T17:55:45Z",
  "published": "2022-04-06T00:01:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1213"
    },
    {
      "type": "WEB",
      "url": "https://github.com/LiveHelperChat/livehelperchat/issues/1752"
    },
    {
      "type": "WEB",
      "url": "https://github.com/livehelperchat/livehelperchat/commit/abc9599ee7aded466ca216741dcaea533c908111"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/livehelperchat/livehelperchat"
    },
    {
      "type": "WEB",
      "url": "https://huntr.dev/bounties/084387f6-5b9c-4017-baa2-5fcf65b051e1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Server side request forgery in LiveHelperChat"
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-22217"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-08-15T18:15:19Z",
    "severity": "MODERATE"
  },
  "details": "A Server-Side Request Forgery (SSRF) vulnerability in Terminalfour before 8.3.19 allows authenticated users to use specific features to access internal services including sensitive information on the server that Terminalfour runs on.",
  "id": "GHSA-hhrv-84gm-4q6x",
  "modified": "2024-09-11T15:31:11Z",
  "published": "2024-08-15T18:31:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22217"
    },
    {
      "type": "WEB",
      "url": "https://docs.terminalfour.com/articles/release-notes-highlights"
    },
    {
      "type": "WEB",
      "url": "https://docs.terminalfour.com/release-notes/security-notices/cve-2024-22217"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-43698"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-04-15T02:15:00Z",
    "severity": "MODERATE"
  },
  "details": "OX App Suite before 7.10.6-rev30 allows SSRF because changing a POP3 account disregards the deny-list.",
  "id": "GHSA-hhvh-f9m6-hq8f",
  "modified": "2024-04-04T03:29:01Z",
  "published": "2023-04-15T03:30:14Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43698"
    },
    {
      "type": "WEB",
      "url": "https://open-xchange.com"
    },
    {
      "type": "WEB",
      "url": "https://seclists.org/fulldisclosure/2023/Feb/3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-15297"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-11-09T09:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "Insufficient validation in the Bitdefender Update Server and BEST Relay components of Bitdefender Endpoint Security Tools versions prior to 6.6.20.294 allows an unprivileged attacker to bypass the in-place mitigations and interact with hosts on the network. This issue affects: Bitdefender Update Server versions prior to 6.6.20.294.",
  "id": "GHSA-hhwp-8mhp-w9rv",
  "modified": "2022-05-24T17:33:37Z",
  "published": "2022-05-24T17:33:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15297"
    },
    {
      "type": "WEB",
      "url": "https://www.bitdefender.com/support/security-advisories/server-side-request-forgery-bitdefender-update-server-va-9163"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.nepxion:discovery"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "6.16.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-23464"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-09-28T03:30:26Z",
    "nvd_published_at": "2022-09-24T05:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Nepxion Discovery is a solution for Spring Cloud. Discovery is vulnerable to a potential Server-Side Request Forgery (SSRF). RouterResourceImpl uses RestTemplate\u2019s getForEntity to retrieve the contents of a URL containing user-controlled input, potentially resulting in Information Disclosure. There is no patch available for this issue at time of publication. There are no known workarounds.",
  "id": "GHSA-hhxh-qphc-v423",
  "modified": "2022-09-28T03:30:26Z",
  "published": "2022-09-25T00:00:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23464"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Nepxion/Discovery"
    },
    {
      "type": "ADVISORY",
      "url": "https://securitylab.github.com/advisories/GHSL-2022-033_GHSL-2022-034_Discovery"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Nepxion Discovery vulnerable to potential Information Disclosure due to  Server-Side Request Forgery "
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-46262"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-12-19T16:15:11Z",
    "severity": "HIGH"
  },
  "details": "An unauthenticated attacked could send a specifically crafted web request causing a Server-Side Request Forgery (SSRF) in Ivanti Avalanche Remote Control server.",
  "id": "GHSA-hj3r-2hqm-4f6w",
  "modified": "2023-12-19T18:30:31Z",
  "published": "2023-12-19T18:30:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46262"
    },
    {
      "type": "WEB",
      "url": "https://download.wavelink.com/Files/avalanche_v6.4.2_release_notes.txt"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "mautic/core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.4.0"
            },
            {
              "fixed": "4.4.17"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "mautic/core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0-alpha"
            },
            {
              "fixed": "5.2.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "mautic/core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.0.0-alpha"
            },
            {
              "fixed": "6.0.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-9821"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-09-03T22:11:32Z",
    "nvd_published_at": "2025-09-03T10:15:38Z",
    "severity": "LOW"
  },
  "details": "### Summary\nUsers with webhook permissions can conduct SSRF via webhooks. If they have permission to view the webhook logs, the (partial) request response is also disclosed\n\n### Details\nWhen sending webhooks, the destination is not validated, causing SSRF.\n\n### Impact\nBypass of firewalls to interact with internal services. \nSee https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/ for more potential impact.\n\n### Resources\nhttps://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html for more information on SSRF and its fix",
  "id": "GHSA-hj6f-7hp7-xg69",
  "modified": "2025-09-03T22:11:32Z",
  "published": "2025-09-03T22:11:32Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/mautic/mautic/security/advisories/GHSA-hj6f-7hp7-xg69"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9821"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mautic/mautic/commit/6084f6de4c88d1aeb5f6c73ea4fe1b09c98ea52b"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mautic/mautic/commit/dc5bb1466c9a48fd34768dc8ff5888716b2916ba"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mautic/mautic"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Mautic vulnerable to SSRF via webhook function"
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-25241"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-02-04T20:15:00Z",
    "severity": "MODERATE"
  },
  "details": "A server-side request forgery (SSRF) information disclosure vulnerability in Trend Micro Apex One and Worry-Free Business Security 10.0 SP1 could allow an unauthenticated user to locate online agents via a sweep.",
  "id": "GHSA-hj87-9mrp-3rp8",
  "modified": "2022-05-24T17:41:07Z",
  "published": "2022-05-24T17:41:07Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25241"
    },
    {
      "type": "WEB",
      "url": "https://success.trendmicro.com/solution/000284202"
    },
    {
      "type": "WEB",
      "url": "https://success.trendmicro.com/solution/000284206"
    },
    {
      "type": "WEB",
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-21-114"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-23082"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-01-14T02:15:08Z",
    "severity": "HIGH"
  },
  "details": "Veeam Backup for Microsoft Azure is vulnerable to Server-Side Request Forgery (SSRF). This may allow an unauthenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.",
  "id": "GHSA-hj9f-h3qv-vpjm",
  "modified": "2025-01-14T03:31:42Z",
  "published": "2025-01-14T03:31:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23082"
    },
    {
      "type": "WEB",
      "url": "https://www.veeam.com/kb4709"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}