CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
4714 vulnerabilities reference this CWE, most recent first.
GHSA-J5JQ-JCVC-GXXC
Vulnerability from github – Published: 2026-07-16 15:33 – Updated: 2026-07-16 15:33stoatchat before 0.13.5 contains an unauthenticated server-side request forgery vulnerability in the /proxy and /embed endpoints that accept arbitrary URLs without DNS resolution filtering or private IP range validation. Attackers can enumerate internal services, fingerprint applications, and reach instance metadata endpoints by supplying malicious URLs or leveraging redirect chains to access internal infrastructure.
{
"affected": [],
"aliases": [
"CVE-2026-63306"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-16T13:16:33Z",
"severity": "CRITICAL"
},
"details": "stoatchat before 0.13.5 contains an unauthenticated server-side request forgery vulnerability in the /proxy and /embed endpoints that accept arbitrary URLs without DNS resolution filtering or private IP range validation. Attackers can enumerate internal services, fingerprint applications, and reach instance metadata endpoints by supplying malicious URLs or leveraging redirect chains to access internal infrastructure.",
"id": "GHSA-j5jq-jcvc-gxxc",
"modified": "2026-07-16T15:33:10Z",
"published": "2026-07-16T15:33:10Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/stoatchat/stoatchat/security/advisories/GHSA-xhww-5g9p-vvq5"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63306"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/stoatchat-before-unauthenticated-ssrf-via-proxy-and-embed-endpoints"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-J5M6-WQRX-CH36
Vulnerability from github – Published: 2025-06-23 18:30 – Updated: 2025-06-23 18:30A vulnerability was found in Dromara MaxKey up to 4.1.7 and classified as critical. This issue affects the function Add of the file maxkey-webs\maxkey-web-mgt\src\main\java\org\dromara\maxkey\web\apps\contorller\SAML20DetailsController.java of the component Meta URL Handler. The manipulation of the argument post leads to server-side request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2025-6517"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-23T18:15:22Z",
"severity": "MODERATE"
},
"details": "A vulnerability was found in Dromara MaxKey up to 4.1.7 and classified as critical. This issue affects the function Add of the file maxkey-webs\\maxkey-web-mgt\\src\\main\\java\\org\\dromara\\maxkey\\web\\apps\\contorller\\SAML20DetailsController.java of the component Meta URL Handler. The manipulation of the argument post leads to server-side request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-j5m6-wqrx-ch36",
"modified": "2025-06-23T18:30:27Z",
"published": "2025-06-23T18:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6517"
},
{
"type": "WEB",
"url": "https://github.com/honorseclab/vulns/blob/main/dromara_MaxKey/SSRF.md"
},
{
"type": "WEB",
"url": "https://github.com/honorseclab/vulns/blob/main/dromara_MaxKey/SSRF.md#vulnerability-verification"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.313637"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.313637"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.593111"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-J5P5-V7RM-VGW7
Vulnerability from github – Published: 2024-12-19 18:31 – Updated: 2024-12-19 18:31IBM Security Guardium 11.5 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
{
"affected": [],
"aliases": [
"CVE-2024-49336"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-19T18:15:22Z",
"severity": "MODERATE"
},
"details": "IBM Security Guardium 11.5 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.",
"id": "GHSA-j5p5-v7rm-vgw7",
"modified": "2024-12-19T18:31:38Z",
"published": "2024-12-19T18:31:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-49336"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7179369"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-J5QP-P44G-2M49
Vulnerability from github – Published: 2026-07-02 19:08 – Updated: 2026-07-02 19:08Finding
Location: core/src/shared/secure-fetch.ts
assertSecureUrl validated only the initial request URL. The fetch() API follows redirects by default (up to 20 hops). A request to a valid https:// URL could redirect to http://internal-service/ or other unvalidated destinations.
Status
Fixed in v0.2.136 — secureFetch now defaults to redirect: 'error' which rejects any redirect. Callers can override with { redirect: 'follow' } if they trust the target.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@asymmetric-effort/specifyjs"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.2.136"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-02T19:08:04Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "## Finding\n\n**Location**: `core/src/shared/secure-fetch.ts`\n\n`assertSecureUrl` validated only the initial request URL. The `fetch()` API follows redirects by default (up to 20 hops). A request to a valid `https://` URL could redirect to `http://internal-service/` or other unvalidated destinations.\n\n## Status\n\n**Fixed in v0.2.136** \u2014 `secureFetch` now defaults to `redirect: \u0027error\u0027` which rejects any redirect. Callers can override with `{ redirect: \u0027follow\u0027 }` if they trust the target.",
"id": "GHSA-j5qp-p44g-2m49",
"modified": "2026-07-02T19:08:04Z",
"published": "2026-07-02T19:08:04Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/asymmetric-effort/specifyjs/security/advisories/GHSA-j5qp-p44g-2m49"
},
{
"type": "WEB",
"url": "https://github.com/asymmetric-effort/specifyjs/commit/25d1fb491d99479efdf501f5f75e0bb80c908f0a"
},
{
"type": "PACKAGE",
"url": "https://github.com/asymmetric-effort/specifyjs"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "@asymmetric-effort/specifyjs: No redirect target validation in secureFetch"
}
GHSA-J62C-4X62-9R35
Vulnerability from github – Published: 2026-01-15 18:09 – Updated: 2026-01-15 22:33Summary
Versions of SvelteKit are vulnerable to a server side request forgery (SSRF) and denial of service (DoS) under certain conditions.
Details
Affected versions from 2.44.0 onwards are vulnerable to DoS if:
- your app has at least one prerendered route (
export const prerender = true)
Affected versions from 2.19.0 onwards are vulnerable to DoS and SSRF if:
- your app has at least one prerendered route (
export const prerender = true) - AND you are using
adapter-nodewithout a configuredORIGINenvironment variable, and you are not using a reverse proxy that implements Host header validation
Impact
The DoS causes the running server process to end.
The SSRF allows access to internal services that can be reached without authentication when fetched from SvelteKit's server runtime.
It is also possible to obtain an SXSS via cache poisoning, by forcing a potential CDN to cache an XSS returned by the attacker's server (the latter being able to specify the cache-control of their choice).
Credits
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.49.4"
},
"package": {
"ecosystem": "npm",
"name": "@sveltejs/kit"
},
"ranges": [
{
"events": [
{
"introduced": "2.19.0"
},
{
"fixed": "2.49.5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 5.5.0"
},
"package": {
"ecosystem": "npm",
"name": "@sveltejs/adapter-node"
},
"ranges": [
{
"events": [
{
"introduced": "5.4.1"
},
{
"fixed": "5.5.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-67647"
],
"database_specific": {
"cwe_ids": [
"CWE-248",
"CWE-400",
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-01-15T18:09:59Z",
"nvd_published_at": "2026-01-15T19:16:03Z",
"severity": "HIGH"
},
"details": "### Summary\n\nVersions of SvelteKit are vulnerable to a server side request forgery (SSRF) and denial of service (DoS) under certain conditions.\n\n### Details\n\nAffected versions from 2.44.0 onwards are vulnerable to DoS if:\n\n- your app has at least one prerendered route (`export const prerender = true`)\n\nAffected versions from 2.19.0 onwards are vulnerable to DoS and SSRF if:\n\n- your app has at least one prerendered route (`export const prerender = true`)\n- AND you are using `adapter-node` without a configured `ORIGIN` environment variable, and you are not using a reverse proxy that implements Host header validation\n\n### Impact\n\nThe DoS causes the running server process to end.\n\nThe SSRF allows access to internal services that can be reached without authentication when fetched from SvelteKit\u0027s server runtime.\n\nIt is also possible to obtain an SXSS via cache poisoning, by forcing a potential CDN to cache an XSS returned by the attacker\u0027s server (the latter being able to specify the cache-control of their choice).\n\n### Credits\n- Allam Rachid ([zhero;](https://zhero-web-sec.github.io/research-and-things/))\n- Allam Yasser (inzo)\n- d-xuan ([wednesday](https://d-xuan.github.io/wednesday/))",
"id": "GHSA-j62c-4x62-9r35",
"modified": "2026-01-15T22:33:31Z",
"published": "2026-01-15T18:09:59Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/sveltejs/kit/security/advisories/GHSA-j62c-4x62-9r35"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67647"
},
{
"type": "WEB",
"url": "https://github.com/sveltejs/kit/commit/d9ae9b00b14f5574d109f3fd548f960594346226"
},
{
"type": "PACKAGE",
"url": "https://github.com/sveltejs/kit"
},
{
"type": "WEB",
"url": "https://github.com/sveltejs/kit/releases/tag/%40sveltejs%2Fadapter-node%405.5.1"
},
{
"type": "WEB",
"url": "https://github.com/sveltejs/kit/releases/tag/%40sveltejs%2Fkit%402.49.5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:H/SC:L/SI:L/SA:N",
"type": "CVSS_V4"
}
],
"summary": "SvelteKit is vulnerable to denial of service and possible SSRF when using prerendering"
}
GHSA-J665-969M-HG73
Vulnerability from github – Published: 2022-05-24 17:42 – Updated: 2025-10-22 00:32Accellion FTA 9_12_411 and earlier is affected by SSRF via a crafted POST request to wmProgressstat.html. The fixed version is FTA_9_12_416 and later.
{
"affected": [],
"aliases": [
"CVE-2021-27103"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-02-16T21:15:00Z",
"severity": "CRITICAL"
},
"details": "Accellion FTA 9_12_411 and earlier is affected by SSRF via a crafted POST request to wmProgressstat.html. The fixed version is FTA_9_12_416 and later.",
"id": "GHSA-j665-969m-hg73",
"modified": "2025-10-22T00:32:03Z",
"published": "2022-05-24T17:42:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-27103"
},
{
"type": "WEB",
"url": "https://github.com/accellion/CVEs/blob/main/CVE-2021-27103.txt"
},
{
"type": "WEB",
"url": "https://www.accellion.com/products/fta"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27103"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-J66Q-H2JJ-3578
Vulnerability from github – Published: 2022-05-24 19:09 – Updated: 2022-05-24 19:09The OnAir2 WordPress theme before 3.9.9.2 and QT KenthaRadio WordPress plugin before 2.0.2 have exposed proxy functionality to unauthenticated users, sending requests to this proxy functionality will have the web server fetch and display the content from any URI, this would allow for SSRF (Server Side Request Forgery) and RFI (Remote File Inclusion) vulnerabilities on the website.
{
"affected": [],
"aliases": [
"CVE-2021-24472"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-08-02T11:15:00Z",
"severity": "CRITICAL"
},
"details": "The OnAir2 WordPress theme before 3.9.9.2 and QT KenthaRadio WordPress plugin before 2.0.2 have exposed proxy functionality to unauthenticated users, sending requests to this proxy functionality will have the web server fetch and display the content from any URI, this would allow for SSRF (Server Side Request Forgery) and RFI (Remote File Inclusion) vulnerabilities on the website.",
"id": "GHSA-j66q-h2jj-3578",
"modified": "2022-05-24T19:09:39Z",
"published": "2022-05-24T19:09:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-24472"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/17591ac5-88fa-4cae-a61a-4dcf5dc0b72a"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-J6C2-7RV4-43QJ
Vulnerability from github – Published: 2025-12-09 00:31 – Updated: 2025-12-11 00:30IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
{
"affected": [],
"aliases": [
"CVE-2025-12832"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-08T22:15:49Z",
"severity": "MODERATE"
},
"details": "IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated\u00a0attacker to send unauthorized requests from the system, potentially leading to network enumeration or\u00a0facilitating other attacks.",
"id": "GHSA-j6c2-7rv4-43qj",
"modified": "2025-12-11T00:30:28Z",
"published": "2025-12-09T00:31:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12832"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7253507"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-J6C7-M83J-8WQG
Vulnerability from github – Published: 2024-06-27 21:32 – Updated: 2024-06-27 21:32A Server-Side Request Forgery (SSRF) vulnerability exists in the upload processing interface of gaizhenbiao/ChuanhuChatGPT versions <= ChuanhuChatGPT-20240410-git.zip. This vulnerability allows attackers to send crafted requests from the vulnerable server to internal or external resources, potentially bypassing security controls and accessing sensitive data.
{
"affected": [],
"aliases": [
"CVE-2024-5822"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-27T19:15:16Z",
"severity": "HIGH"
},
"details": "A Server-Side Request Forgery (SSRF) vulnerability exists in the upload processing interface of gaizhenbiao/ChuanhuChatGPT versions \u003c= ChuanhuChatGPT-20240410-git.zip. This vulnerability allows attackers to send crafted requests from the vulnerable server to internal or external resources, potentially bypassing security controls and accessing sensitive data.",
"id": "GHSA-j6c7-m83j-8wqg",
"modified": "2024-06-27T21:32:08Z",
"published": "2024-06-27T21:32:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5822"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/b24f1b5f-a529-435b-ac4d-5ca71d5d1fb5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-J6GP-9P24-6XR9
Vulnerability from github – Published: 2023-08-30 15:30 – Updated: 2023-08-30 15:30Server-Side Request Forgery (SSRF) in GitHub repository bookstackapp/bookstack prior to v23.08.
{
"affected": [],
"aliases": [
"CVE-2023-4624"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-08-30T13:15:15Z",
"severity": "LOW"
},
"details": "Server-Side Request Forgery (SSRF) in GitHub repository bookstackapp/bookstack prior to v23.08.",
"id": "GHSA-j6gp-9p24-6xr9",
"modified": "2023-08-30T15:30:19Z",
"published": "2023-08-30T15:30:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4624"
},
{
"type": "WEB",
"url": "https://github.com/bookstackapp/bookstack/commit/c324ad928dbdd54ce5b09eb0dabe60ef9de1ea38"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/9ce5cef6-e546-44e7-addf-a2726fa4e60c"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.