CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
4691 vulnerabilities reference this CWE, most recent first.
GHSA-M985-797H-4F3F
Vulnerability from github – Published: 2026-01-13 18:31 – Updated: 2026-01-13 18:31Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
{
"affected": [],
"aliases": [
"CVE-2026-20958"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-13T18:16:23Z",
"severity": "MODERATE"
},
"details": "Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.",
"id": "GHSA-m985-797h-4f3f",
"modified": "2026-01-13T18:31:11Z",
"published": "2026-01-13T18:31:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20958"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20958"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-M9FP-RCW9-GVFW
Vulnerability from github – Published: 2023-06-10 03:30 – Updated: 2023-06-10 03:30Server-Side Request Forgery (SSRF) in GitHub repository owncast/owncast prior to 0.1.0.
{
"affected": [],
"aliases": [
"CVE-2023-3188"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-06-10T02:15:09Z",
"severity": "HIGH"
},
"details": "Server-Side Request Forgery (SSRF) in GitHub repository owncast/owncast prior to 0.1.0.",
"id": "GHSA-m9fp-rcw9-gvfw",
"modified": "2023-06-10T03:30:31Z",
"published": "2023-06-10T03:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3188"
},
{
"type": "WEB",
"url": "https://github.com/owncast/owncast/commit/f40135dbf28093864482f9662c23e478ea192b16"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/0d0d526a-1c39-4e6a-b081-d3914468e495"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-M9GF-7PR5-72CF
Vulnerability from github – Published: 2022-12-21 18:30 – Updated: 2022-12-21 18:30Adobe Campaign version 7.3.1 (and earlier) and 8.3.9 (and earlier) are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. A low-privilege authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction.
{
"affected": [],
"aliases": [
"CVE-2022-42343"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-12-16T16:15:00Z",
"severity": "MODERATE"
},
"details": "Adobe Campaign version 7.3.1 (and earlier) and 8.3.9 (and earlier) are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. A low-privilege authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction.",
"id": "GHSA-m9gf-7pr5-72cf",
"modified": "2022-12-21T18:30:23Z",
"published": "2022-12-21T18:30:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42343"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/campaign/apsb22-58.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-MC26-Q38V-83GV
Vulnerability from github – Published: 2026-03-31 06:31 – Updated: 2026-04-01 23:16OpenStack Glance versions < 29.1.1, >= 30.0.0 < 30.1.1, == 31.0.0 are affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated user can bypass URL validation checks and redirect to internal services. Only the glance image import functionality is affected. In particular, the web-download and glance-download import methods are subject to this vulnerability, as is the optional (not enabled by default) ovf_process image import plugin.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "glance"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "29.2.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "glance"
},
"ranges": [
{
"events": [
{
"introduced": "30.0.0"
},
{
"fixed": "30.2.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "glance"
},
"ranges": [
{
"events": [
{
"introduced": "31.0.0"
},
{
"fixed": "31.1.0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"31.0.0"
]
}
],
"aliases": [
"CVE-2026-34881"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-01T23:16:39Z",
"nvd_published_at": "2026-03-31T06:16:01Z",
"severity": "MODERATE"
},
"details": "OpenStack Glance versions \u003c 29.1.1, \u003e= 30.0.0 \u003c 30.1.1, == 31.0.0 are affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated user can bypass URL validation checks and redirect to internal services. Only the glance image import functionality is affected. In particular, the web-download and glance-download import methods are subject to this vulnerability, as is the optional (not enabled by default) ovf_process image import plugin.",
"id": "GHSA-mc26-q38v-83gv",
"modified": "2026-04-01T23:16:39Z",
"published": "2026-03-31T06:31:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34881"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/glance/+bug/2138602"
},
{
"type": "PACKAGE",
"url": "https://github.com/openstack/glance"
},
{
"type": "WEB",
"url": "https://security.openstack.org/ossa/OSSA-2026-004.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "OpenStack Glance is affected by Server-Side Request Forgery (SSRF)"
}
GHSA-MC43-4FQR-C965
Vulnerability from github – Published: 2025-06-10 14:13 – Updated: 2025-06-10 15:35Summary
An improper URI validation vulnerability exists that enables an unauthorized attacker to perform XML External Entities (XEE) attack, then send GET request to any HTTP server. Attacker can abuse this to scan internal networks and gain information about them then exploit further. Moreover, attacker can read limited .xsd file on system.
Details
By default, GeoServer use PreventLocalEntityResolver class from GeoTools to filter out malicious URIs in XML entities before resolving them. The URI must match the regex (?i)(jar:file|http|vfs)[^?#;]*\\.xsd. But the regex leaves a chance for attackers to request to any HTTP server or limited file.
Impact
An unauthenticated attacker can:
1. Scan internal network to gain insight about it and exploit further.
2. SSRF to endpoint ends with .xsd.
3. Read limited .xsd file on system.
Mitigation
- Define the system property
ENTITY_RESOLUTION_ALLOWLISTto limit the supported external schema locaitons. - The built-in allow list covers the locations required for the operation of OGC web services:
www.w3.org,schemas.opengis.net,www.opengis.net,inspire.ec.europa.eu/schemas. - The user guide provides details on how to add additional locations (this is required for app-schema plugin where a schema is supplied to define an output format).
Resolution
- GeoServer 2.25.0 and greater default to the use of
ENTITY_RESOLUTION_ALLOWLISTand does not require you to provide a system property. - The use of
ENTITY_RESOLUTION_ALLOWLISTis still supported if you require additional schema locations to be supported beyond the built-in allow list. - GeoServer 2.25.1 change
ENTITY_RESOLUTION_ALLOWLISTno longer supports regular expressions
References
- External Entities Resolution (GeoServer User Guide)
Credits
- Le Mau Anh Phong from VNG Security Response Center & VNUHCM - University of Information Technology
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.geoserver.web:gs-web-app"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.25.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.geoserver.main:gs-main"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.25.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-34711"
],
"database_specific": {
"cwe_ids": [
"CWE-20",
"CWE-200",
"CWE-611",
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2025-06-10T14:13:44Z",
"nvd_published_at": "2025-06-10T15:15:22Z",
"severity": "CRITICAL"
},
"details": "### Summary\nAn improper URI validation vulnerability exists that enables an unauthorized attacker to perform XML External Entities (XEE) attack, then send GET request to any HTTP server. Attacker can abuse this to scan internal networks and gain information about them then exploit further. Moreover, attacker can read limited `.xsd` file on system.\n\n### Details\nBy default, GeoServer use `PreventLocalEntityResolver` class from GeoTools to filter out malicious URIs in XML entities before resolving them. The URI must match the regex `(?i)(jar:file|http|vfs)[^?#;]*\\\\.xsd`. But the regex leaves a chance for attackers to request to any HTTP server or limited file.\n\n### Impact\n\nAn unauthenticated attacker can:\n1. Scan internal network to gain insight about it and exploit further.\n2. SSRF to endpoint ends with `.xsd`.\n3. Read limited `.xsd` file on system.\n\n### Mitigation\n\n1. Define the system property ``ENTITY_RESOLUTION_ALLOWLIST`` to limit the supported external schema locaitons.\n2. The built-in allow list covers the locations required for the operation of OGC web services: ``www.w3.org``,``schemas.opengis.net``,``www.opengis.net``,``inspire.ec.europa.eu/schemas``.\n3. The [user guide](https://docs.geoserver.org/latest/en/user/production/config.html#production-config-external-entities) provides details on how to add additional locations (this is required for app-schema plugin where a schema is supplied to define an output format).\n\n### Resolution \n\n1. GeoServer 2.25.0 and greater default to the use of ``ENTITY_RESOLUTION_ALLOWLIST`` and does not require you to provide a system property.\n2. The use of ``ENTITY_RESOLUTION_ALLOWLIST`` is still supported if you require additional schema locations to be supported beyond the built-in allow list.\n3. GeoServer 2.25.1 change ``ENTITY_RESOLUTION_ALLOWLIST `` no longer supports regular expressions\n\n### References\n\n* [External Entities Resolution](https://docs.geoserver.org/latest/en/user/production/config.html#production-config-external-entities) (GeoServer User Guide)\n\n### Credits\n* Le Mau Anh Phong from VNG Security Response Center \u0026 VNUHCM - University of Information Technology",
"id": "GHSA-mc43-4fqr-c965",
"modified": "2025-06-10T15:35:23Z",
"published": "2025-06-10T14:13:44Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/geoserver/geoserver/security/advisories/GHSA-mc43-4fqr-c965"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34711"
},
{
"type": "WEB",
"url": "https://docs.geoserver.org/latest/en/user/production/config.html#production-config-external-entities"
},
{
"type": "PACKAGE",
"url": "https://github.com/geoserver/geoserver"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "GeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF)"
}
GHSA-MC4Q-3CH6-8CG4
Vulnerability from github – Published: 2024-01-17 00:30 – Updated: 2024-01-17 00:30A vulnerability was found in ZhongFuCheng3y Austin 1.0. It has been rated as critical. Affected by this issue is the function getRemoteUrl2File of the file src\main\java\com\java3y\austin\support\utils\AustinFileUtils.java of the component Email Message Template Handler. The manipulation leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-250838 is the identifier assigned to this vulnerability.
{
"affected": [],
"aliases": [
"CVE-2024-0601"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-16T22:15:37Z",
"severity": "MODERATE"
},
"details": "A vulnerability was found in ZhongFuCheng3y Austin 1.0. It has been rated as critical. Affected by this issue is the function getRemoteUrl2File of the file src\\main\\java\\com\\java3y\\austin\\support\\utils\\AustinFileUtils.java of the component Email Message Template Handler. The manipulation leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-250838 is the identifier assigned to this vulnerability.",
"id": "GHSA-mc4q-3ch6-8cg4",
"modified": "2024-01-17T00:30:20Z",
"published": "2024-01-17T00:30:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0601"
},
{
"type": "WEB",
"url": "https://github.com/biantaibao/Austin_SSRF/blob/main/SSRF.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.250838"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.250838"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-MC79-8XP6-RCW8
Vulnerability from github – Published: 2025-12-15 18:30 – Updated: 2025-12-16 21:30An SSTI (Server-Side Template Injection) vulnerability exists in the get_terms_and_conditions method of Frappe ERPNext through 15.89.0. The function renders attacker-controlled Jinja2 templates (terms) using frappe.render_template() with a user-supplied context (doc). Although Frappe uses a custom SandboxedEnvironment, several dangerous globals such as frappe.db.sql are still available in the execution context via get_safe_globals(). An authenticated attacker with access to create or modify a Terms and Conditions document can inject arbitrary Jinja expressions into the terms field, resulting in server-side code execution within a restricted but still unsafe context. This vulnerability can be used to leak database information.
{
"affected": [],
"aliases": [
"CVE-2025-66436"
],
"database_specific": {
"cwe_ids": [
"CWE-1336",
"CWE-918",
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-15T18:15:48Z",
"severity": "MODERATE"
},
"details": "An SSTI (Server-Side Template Injection) vulnerability exists in the get_terms_and_conditions method of Frappe ERPNext through 15.89.0. The function renders attacker-controlled Jinja2 templates (terms) using frappe.render_template() with a user-supplied context (doc). Although Frappe uses a custom SandboxedEnvironment, several dangerous globals such as frappe.db.sql are still available in the execution context via get_safe_globals(). An authenticated attacker with access to create or modify a Terms and Conditions document can inject arbitrary Jinja expressions into the terms field, resulting in server-side code execution within a restricted but still unsafe context. This vulnerability can be used to leak database information.",
"id": "GHSA-mc79-8xp6-rcw8",
"modified": "2025-12-16T21:30:52Z",
"published": "2025-12-15T18:30:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66436"
},
{
"type": "WEB",
"url": "https://iamanc.github.io/post/erpnext-ssti-bug-3"
},
{
"type": "WEB",
"url": "https://www.notion.so/SSTI-bug-3-239e6086eadc8020aeecdaf123e32f3d?source=copy_link"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-MC9M-5HW4-G3G6
Vulnerability from github – Published: 2025-03-20 12:32 – Updated: 2025-03-20 12:32A Server-Side Request Forgery (SSRF) vulnerability was discovered in gaizhenbiao/chuanhuchatgpt version 20240914. The vulnerability allows an attacker to construct a response link by saving the response in a folder named after the SHA-1 hash of the target URL. This enables the attacker to access the response directly, potentially leading to unauthorized access to internal systems, data theft, service disruption, or further attacks such as port scanning and accessing metadata endpoints.
{
"affected": [],
"aliases": [
"CVE-2025-0188"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-20T10:15:51Z",
"severity": "MODERATE"
},
"details": "A Server-Side Request Forgery (SSRF) vulnerability was discovered in gaizhenbiao/chuanhuchatgpt version 20240914. The vulnerability allows an attacker to construct a response link by saving the response in a folder named after the SHA-1 hash of the target URL. This enables the attacker to access the response directly, potentially leading to unauthorized access to internal systems, data theft, service disruption, or further attacks such as port scanning and accessing metadata endpoints.",
"id": "GHSA-mc9m-5hw4-g3g6",
"modified": "2025-03-20T12:32:52Z",
"published": "2025-03-20T12:32:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0188"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/879d2470-eca5-49c0-b3d1-57469cfff412"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-MCG9-64CP-XWP7
Vulnerability from github – Published: 2019-07-05 21:08 – Updated: 2021-08-17 15:47Hawt Hawtio through 2.5.0 is vulnerable to SSRF, allowing a remote attacker to trigger an HTTP request from an affected server to an arbitrary host via the initial /proxy/ substring of a URI.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "io.hawt:hawtio-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.5.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2019-9827"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2019-07-05T20:47:20Z",
"nvd_published_at": "2019-07-03T21:15:00Z",
"severity": "CRITICAL"
},
"details": "Hawt Hawtio through 2.5.0 is vulnerable to SSRF, allowing a remote attacker to trigger an HTTP request from an affected server to an arbitrary host via the initial /proxy/ substring of a URI.",
"id": "GHSA-mcg9-64cp-xwp7",
"modified": "2021-08-17T15:47:23Z",
"published": "2019-07-05T21:08:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9827"
},
{
"type": "WEB",
"url": "https://www.ciphertechs.com/hawtio-advisory"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Server-Side Request Forgery in Hawt Hawtio"
}
GHSA-MCJ8-FF8H-86PH
Vulnerability from github – Published: 2026-07-18 09:32 – Updated: 2026-07-18 09:32A weakness has been identified in Sipeed PicoClaw up to 0.2.9. This impacts the function web_fetch of the file pkg/tools/integration/web.go. This manipulation causes server-side request forgery. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. Patch name: c15aac21fe05ee103a470e1104bc891754e83392. To fix this issue, it is recommended to deploy a patch.
{
"affected": [],
"aliases": [
"CVE-2026-16084"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-18T09:17:08Z",
"severity": "MODERATE"
},
"details": "A weakness has been identified in Sipeed PicoClaw up to 0.2.9. This impacts the function web_fetch of the file pkg/tools/integration/web.go. This manipulation causes server-side request forgery. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. Patch name: c15aac21fe05ee103a470e1104bc891754e83392. To fix this issue, it is recommended to deploy a patch.",
"id": "GHSA-mcj8-ff8h-86ph",
"modified": "2026-07-18T09:32:17Z",
"published": "2026-07-18T09:32:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16084"
},
{
"type": "WEB",
"url": "https://github.com/sipeed/picoclaw/issues/3074"
},
{
"type": "WEB",
"url": "https://github.com/sipeed/picoclaw/pull/3143"
},
{
"type": "WEB",
"url": "https://github.com/sipeed/picoclaw/commit/c15aac21fe05ee103a470e1104bc891754e83392"
},
{
"type": "WEB",
"url": "https://github.com/sipeed/picoclaw"
},
{
"type": "WEB",
"url": "https://vuldb.com/cve/CVE-2026-16084"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/852946"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/379796"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/379796/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.