Common Weakness Enumeration

CWE-918

Allowed

Server-Side Request Forgery (SSRF)

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

6678 vulnerabilities reference this CWE, most recent first.

GHSA-8X5V-CPV7-8JJP

Vulnerability from github – Published: 2026-08-04 19:59 – Updated: 2026-08-04 19:59
VLAI
Summary
Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs
Details

Summary

Open WebUI fetches user-supplied URLs on the server for RAG URL ingestion, URL-to-markdown conversion and web-search content retrieval, and decides whether a destination is allowed by asking whether its IP address is globally routable. That test operates on the literal IPv6 address and does not look at the IPv4 address embedded inside it. On a deployment whose network has a NAT64 gateway, any verified user can wrap an internal or cloud-metadata IPv4 address in the NAT64 well-known prefix, pass the filter, and receive the internal response body back through the API.

Preconditions

  • Any verified (authenticated) user account. No admin role, no elevated permission.
  • Default configuration: ENABLE_LOCAL_WEB_FETCH off, the default WEB_FETCH_FILTER_LIST metadata blocklist in place. Neither prevents this, because the blocklist matches hostname strings and the NAT64 literal is not one of them.
  • The deployment's network must provide NAT64 translation for the well-known 64:ff9b::/96 prefix, which is the common default on IPv6-only and dual-stack cloud and Kubernetes networks.
  • Deployments on IPv4-only networks, or on any network without a NAT64 gateway, are not affected: the address has nowhere to route.

Impact

On an affected network a low-privilege user can read GET responses from services the server can reach but the internet cannot: cloud instance metadata including IAM role credentials, loopback-bound admin surfaces, and internal APIs in the same VPC or cluster. The response body is returned to the caller, so this is full-read, not blind. Exploitation is not universal, it depends entirely on the deployment's network providing NAT64 translation, which is why the score carries high attack complexity. Deployments without NAT64 lose nothing here.

Fix

Fixed in v0.11.0 by commit 1717b493d. Address classification now unwraps the IPv4 embedded in IPv6 transition encodings before deciding whether a destination is global, and applies that at all three checkpoints. NAT64-wrapped public destinations continue to work. Upgrading to v0.11.0 fully resolves the issue with no configuration change.

Root cause

  • backend/open_webui/retrieval/web/utils.py — validate_url(), the pre-fetch check on the submitted URL.
  • backend/open_webui/retrieval/web/utils.py — _ssrf_safe_new_conn() and _SSRFSafeResolver, the connect-time re-checks that defeat DNS rebinding.

All three decided reachability from ipaddress.ip_address(ip).is_global applied to the literal address. That predicate answers whether an IPv6 address sits in globally-routable space, which is a different question from where the packet actually ends up once a transition gateway translates it. The NAT64 well-known prefix is by design a global prefix carrying an arbitrary IPv4 destination, so an internal target wrapped in it satisfies the check while reaching exactly what the check exists to prevent. Because the same predicate backed the connect-time re-checks, no later layer caught it either. The fix inspects every standardized transition encoding rather than only the NAT64 prefix, since the same reasoning error applies to each of them.

Proof of concept

Against the real POST /api/v1/retrieval/process/web flow on v0.10.2 as an authenticated user, with internal HTTP services returning a marker string. The plain forms are rejected with HTTP 400:

http://169.254.169.254/latest/meta-data/          -> 400
http://127.0.0.1/                                 -> 400
http://[::ffff:169.254.169.254]/                  -> 400
http://metadata.google.internal/                  -> 400

The NAT64 encodings of the same targets are accepted, and the response body is returned in the content field:

http://[64:ff9b::a9fe:a9fe]/latest/meta-data/iam/security-credentials/   -> 200, marker returned
http://[64:ff9b::7f00:1]/admin/internal-status                          -> 200, marker returned

NAT64 translation was modelled by binding the translated addresses locally rather than by routing through a real NAT64 gateway; everything else, including the request flow and the validation code, is the unmodified v0.10.2 path. After the fix both URLs return 400 while http://[64:ff9b::808:808]/ (8.8.8.8, public) still returns 200, confirming no over-blocking.

Credits

  • tonghuaroot — reported the transition-form gap in the address classification and supplied the fix approach.
Severity
7.1 (High)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "open-webui"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.9.0"
            },
            {
              "fixed": "0.11.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-70485"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-04T19:59:36Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\nOpen WebUI fetches user-supplied URLs on the server for RAG URL ingestion, URL-to-markdown conversion and web-search content retrieval, and decides whether a destination is allowed by asking whether its IP address is globally routable. That test operates on the literal IPv6 address and does not look at the IPv4 address embedded inside it. On a deployment whose network has a NAT64 gateway, any verified user can wrap an internal or cloud-metadata IPv4 address in the NAT64 well-known prefix, pass the filter, and receive the internal response body back through the API.\n\n## Preconditions\n\n- Any verified (authenticated) user account. No admin role, no elevated permission.\n- Default configuration: `ENABLE_LOCAL_WEB_FETCH` off, the default `WEB_FETCH_FILTER_LIST` metadata blocklist in place. Neither prevents this, because the blocklist matches hostname strings and the NAT64 literal is not one of them.\n- The deployment\u0027s network must provide NAT64 translation for the well-known `64:ff9b::/96` prefix, which is the common default on IPv6-only and dual-stack cloud and Kubernetes networks.\n- Deployments on IPv4-only networks, or on any network without a NAT64 gateway, are not affected: the address has nowhere to route.\n\n## Impact\n\nOn an affected network a low-privilege user can read GET responses from services the server can reach but the internet cannot: cloud instance metadata including IAM role credentials, loopback-bound admin surfaces, and internal APIs in the same VPC or cluster. The response body is returned to the caller, so this is full-read, not blind. Exploitation is not universal, it depends entirely on the deployment\u0027s network providing NAT64 translation, which is why the score carries high attack complexity. Deployments without NAT64 lose nothing here.\n\n## Fix\n\nFixed in v0.11.0 by commit `1717b493d`. Address classification now unwraps the IPv4 embedded in IPv6 transition encodings before deciding whether a destination is global, and applies that at all three checkpoints. NAT64-wrapped public destinations continue to work. Upgrading to v0.11.0 fully resolves the issue with no configuration change.\n\n## Root cause\n\n- `backend/open_webui/retrieval/web/utils.py` \u2014 `validate_url()`, the pre-fetch check on the submitted URL.\n- `backend/open_webui/retrieval/web/utils.py` \u2014 `_ssrf_safe_new_conn()` and `_SSRFSafeResolver`, the connect-time re-checks that defeat DNS rebinding.\n\nAll three decided reachability from `ipaddress.ip_address(ip).is_global` applied to the literal address. That predicate answers whether an IPv6 address sits in globally-routable space, which is a different question from where the packet actually ends up once a transition gateway translates it. The NAT64 well-known prefix is by design a global prefix carrying an arbitrary IPv4 destination, so an internal target wrapped in it satisfies the check while reaching exactly what the check exists to prevent. Because the same predicate backed the connect-time re-checks, no later layer caught it either. The fix inspects every standardized transition encoding rather than only the NAT64 prefix, since the same reasoning error applies to each of them.\n\n## Proof of concept\n\nAgainst the real `POST /api/v1/retrieval/process/web` flow on v0.10.2 as an authenticated user, with internal HTTP services returning a marker string. The plain forms are rejected with HTTP 400:\n\n```\nhttp://169.254.169.254/latest/meta-data/          -\u003e 400\nhttp://127.0.0.1/                                 -\u003e 400\nhttp://[::ffff:169.254.169.254]/                  -\u003e 400\nhttp://metadata.google.internal/                  -\u003e 400\n```\n\nThe NAT64 encodings of the same targets are accepted, and the response body is returned in the `content` field:\n\n```\nhttp://[64:ff9b::a9fe:a9fe]/latest/meta-data/iam/security-credentials/   -\u003e 200, marker returned\nhttp://[64:ff9b::7f00:1]/admin/internal-status                          -\u003e 200, marker returned\n```\n\nNAT64 translation was modelled by binding the translated addresses locally rather than by routing through a real NAT64 gateway; everything else, including the request flow and the validation code, is the unmodified v0.10.2 path. After the fix both URLs return 400 while `http://[64:ff9b::808:808]/` (8.8.8.8, public) still returns 200, confirming no over-blocking.\n\n## Credits\n\n- tonghuaroot \u2014 reported the transition-form gap in the address classification and supplied the fix approach.",
  "id": "GHSA-8x5v-cpv7-8jjp",
  "modified": "2026-08-04T19:59:36Z",
  "published": "2026-08-04T19:59:36Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-8x5v-cpv7-8jjp"
    },
    {
      "type": "WEB",
      "url": "https://github.com/open-webui/open-webui/commit/1717b493d83c86afa82aa8bc50139250852dd2f3"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/open-webui/open-webui"
    },
    {
      "type": "WEB",
      "url": "https://github.com/open-webui/open-webui/releases/tag/v0.11.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs"
}

GHSA-8X9J-8H3W-5CXQ

Vulnerability from github – Published: 2026-09-26 15:31 – Updated: 2026-09-26 15:31
VLAI
Details

Kyverno before 1.19.1 is vulnerable to server-side request forgery. The default egress blocklist (169.254.169.254, 169.254.169.253, metadata.google.internal, 127.0.0.0/8, ::1/128) and the scoped-token control were wired only into the new CEL http.Get/Post library and were never applied to the legacy apiCall service executor (pkg/engine/apicall/executor.go) or to the GlobalContextEntry external-API path, which handle every non-CEL context[].apiCall.service call. Because these paths use a plain net/http client with no egress filtering and no validation of the configured service URL, a ClusterPolicy or GlobalContextEntry author — or, where a deployed policy templates the service URL from the admission resource, a lower-privileged resource submitter — can cause Kyverno to issue GET/POST requests to an arbitrary host, including the cloud metadata endpoint, loopback, and any in-cluster service, reading cloud instance credentials and reaching internal endpoints with Kyverno's network position. The executor also unconditionally attaches Kyverno's projected ServiceAccount token to the attacker-chosen destination; the token is audience-scoped, limiting its replay value. Fixed in 1.19.1.

Severity
7.6 (High)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N
8.3 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-100705"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-26T14:16:55Z",
    "severity": "HIGH"
  },
  "details": "Kyverno before 1.19.1 is vulnerable to server-side request forgery. The default egress blocklist (169.254.169.254, 169.254.169.253, metadata.google.internal, 127.0.0.0/8, ::1/128) and the scoped-token control were wired only into the new CEL http.Get/Post library and were never applied to the legacy apiCall service executor (pkg/engine/apicall/executor.go) or to the GlobalContextEntry external-API path, which handle every non-CEL context[].apiCall.service call. Because these paths use a plain net/http client with no egress filtering and no validation of the configured service URL, a ClusterPolicy or GlobalContextEntry author \u2014 or, where a deployed policy templates the service URL from the admission resource, a lower-privileged resource submitter \u2014 can cause Kyverno to issue GET/POST requests to an arbitrary host, including the cloud metadata endpoint, loopback, and any in-cluster service, reading cloud instance credentials and reaching internal endpoints with Kyverno\u0027s network position. The executor also unconditionally attaches Kyverno\u0027s projected ServiceAccount token to the attacker-chosen destination; the token is audience-scoped, limiting its replay value. Fixed in 1.19.1.",
  "id": "GHSA-8x9j-8h3w-5cxq",
  "modified": "2026-09-26T15:31:23Z",
  "published": "2026-09-26T15:31:22Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/kyverno/kyverno/security/advisories/GHSA-q825-p383-r9v5"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100705"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/kyverno-before-1.19.1-ssrf-via-legacy-apicall-service-executor"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-8XCX-2PHJ-G7JH

Vulnerability from github – Published: 2026-09-01 21:31 – Updated: 2026-09-01 21:31
VLAI
Details

A vulnerability in the web-based management interface of AOS-CX could allow an authenticated remote attacker to conduct a server-side request forgery (SSRF) attack. A successful exploit allows an attacker to enumerate information about the internal structure of the AOS-CX host, leading to potential disclosure and limited modification of sensitive information.

Severity
6.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-73757"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-01T21:18:42Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability in the web-based management interface of AOS-CX could allow an authenticated remote attacker to conduct a server-side request forgery (SSRF) attack. A successful exploit allows an attacker to enumerate information about the internal structure of the AOS-CX host, leading to potential disclosure and limited modification of sensitive information.",
  "id": "GHSA-8xcx-2phj-g7jh",
  "modified": "2026-09-01T21:31:51Z",
  "published": "2026-09-01T21:31:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73757"
    },
    {
      "type": "WEB",
      "url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05134en_us\u0026docLocale=en_US"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-8XMV-482H-9XQG

Vulnerability from github – Published: 2022-05-24 19:09 – Updated: 2022-05-24 19:09
VLAI
Details

IBM Jazz Foundation products are vulnerable to server side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 192434.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2020-4974"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-07-28T13:15:00Z",
    "severity": "MODERATE"
  },
  "details": "IBM Jazz Foundation products are vulnerable to server side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.  IBM X-Force ID:  192434.",
  "id": "GHSA-8xmv-482h-9xqg",
  "modified": "2022-05-24T19:09:17Z",
  "published": "2022-05-24T19:09:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-4974"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/192434"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/6475919"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-8XPW-Q9JP-X2C7

Vulnerability from github – Published: 2022-07-15 00:00 – Updated: 2022-07-22 00:00
VLAI
Details

Best Practical RT for Incident Response (RTIR) before 4.0.3 and 5.x before 5.0.3 allows SSRF via the whois lookup tool.

Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-25800"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-07-14T12:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "Best Practical RT for Incident Response (RTIR) before 4.0.3 and 5.x before 5.0.3 allows SSRF via the whois lookup tool.",
  "id": "GHSA-8xpw-q9jp-x2c7",
  "modified": "2022-07-22T00:00:33Z",
  "published": "2022-07-15T00:00:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25800"
    },
    {
      "type": "WEB",
      "url": "https://docs.bestpractical.com/release-notes/rtir/4.0.3"
    },
    {
      "type": "WEB",
      "url": "https://docs.bestpractical.com/release-notes/rtir/5.0.3"
    },
    {
      "type": "WEB",
      "url": "https://docs.bestpractical.com/release-notes/rtir/index.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-8XQ3-W9FX-74RV

Vulnerability from github – Published: 2025-07-28 16:41 – Updated: 2025-08-01 18:36
VLAI
Summary
webfinger.js Blind SSRF Vulnerability
Details

Description

The lookup function takes a user address for checking accounts as a feature, however, as per the ActivityPub spec (https://www.w3.org/TR/activitypub/#security-considerations), on the security considerations section at B.3, access to Localhost services should be prevented while running in production. The library does not prevent Localhost access (neither does it prevent LAN addresses such as 192.168.x.x) , thus is not safe for use in production by ActivityPub applications. The only check for localhost is done for selecting between HTTP and HTTPS protocols, and it is done by testing for a host that starts with the string “localhost” and ends with a port. Anything else (such as “127.0.0.1” or “localhost:1234/abc”) would not be considered localhost for this test.

In addition, the way that the function determines the host, makes it possible to access any path in the host, not only “/.well-known/...” paths:

if (address.indexOf('://') > -1) {
  // other uri format
  host = address.replace(/ /g,'').split('/')[2];
} else {
  // useraddress
  host = address.replace(/ /g,'').split('@')[1];
}

var uri_index = 0; // track which URIS we've tried already
var protocol = 'https'; // we use https by default

if (self.__isLocalhost(host)) {
  protocol = 'http';
}

function __buildURL() {
  var uri = '';
  if (! address.split('://')[1]) {
  // the URI has not been defined, default to acct
    uri = 'acct:';
  }
  return protocol + '://' + host + '/.well-known/' +URIS[uri_index] + '?resource=' + uri + address;
}

If the address is in the format of a user address (user@host.com), the host will be anything after the first found @ symbol. Since no other test is done, an adversary may pass a specially crafted address such as user@localhost:7000/admin/restricted_page? and reach pages that would normally be out of reach. In this example, the code would treat localhost:7000/admin/restricted_page? as the host, and the created URL would be https://localhost:7000/admin/restricted_page?/.well-known/webfinger?resource=acct:use r@localhost:7000/admin/restricted_page?. A server listening on localhost:7000 will then parse the request as a GET request for the page /admin/restricted_page with the query string /.well-known/webfinger?resource=acct:user@localhost:7000/admin/restricted_page?.

PoC and Steps to reproduce

This PoC assumes that there is a server on the machine listening on port 3000, which receives requests for WebFinger lookups on the address /api/v1/search_user, and then calls the lookup function in webfinger.js with the user passed as an argument. For the sake of the example we assume that the server configured webfinger.js with tls_only=false.

  1. Activate a local HTTP server listening to port 1234 with a “secret.txt” file:
python3 -m http.server 1234
  1. Run the following command:
curl
"http://localhost:3000/api/v1/search_user?search=user@localhost:1234/secret.txt
?"
  1. View the console of the Python’s HTTP server and see that a request for a “secret.txt?/.well-known/webfinger?resource=acct:user@localhost:1234/secret.txt ?” file was performed. This proves that we can redirect the URL to any domain and path we choose, including localhost and the internal LAN.

Impact

Due to this issue, any user can cause a server using the library to send GET requests with controlled host, path and port in an attempt to query services running on the instance’s host or local network, and attempt to execute a Blind-SSRF gadget in hope of targeting a known vulnerable local service running on the victim’s machine.

References

The vulnerability was discovered by Ori Hollander of the JFrog Vulnerability Research team.

Severity
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.8.0"
      },
      "package": {
        "ecosystem": "npm",
        "name": "webfinger.js"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-54590"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-07-28T16:41:06Z",
    "nvd_published_at": "2025-08-01T18:15:55Z",
    "severity": "MODERATE"
  },
  "details": "### Description\nThe lookup function takes a user address for checking accounts as a feature, however, as per\nthe ActivityPub spec (https://www.w3.org/TR/activitypub/#security-considerations), on the\nsecurity considerations section at B.3, access to Localhost services should be prevented while\nrunning in production. The library does not prevent Localhost access (neither does it prevent\nLAN addresses such as 192.168.x.x) , thus is not safe for use in production by ActivityPub\napplications. The only check for localhost is done for selecting between HTTP and HTTPS\nprotocols, and it is done by testing for a host that starts with the string \u201clocalhost\u201d and ends with\na port. Anything else (such as \u201c127.0.0.1\u201d or \u201clocalhost:1234/abc\u201d) would not be considered\nlocalhost for this test.\n\nIn addition, the way that the function determines the host, makes it possible to access any path\nin the host, not only \u201c/.well-known/...\u201d paths:\n\n```javascript\nif (address.indexOf(\u0027://\u0027) \u003e -1) {\n  // other uri format\n  host = address.replace(/ /g,\u0027\u0027).split(\u0027/\u0027)[2];\n} else {\n  // useraddress\n  host = address.replace(/ /g,\u0027\u0027).split(\u0027@\u0027)[1];\n}\n\nvar uri_index = 0; // track which URIS we\u0027ve tried already\nvar protocol = \u0027https\u0027; // we use https by default\n\nif (self.__isLocalhost(host)) {\n  protocol = \u0027http\u0027;\n}\n\nfunction __buildURL() {\n  var uri = \u0027\u0027;\n  if (! address.split(\u0027://\u0027)[1]) {\n  // the URI has not been defined, default to acct\n    uri = \u0027acct:\u0027;\n  }\n  return protocol + \u0027://\u0027 + host + \u0027/.well-known/\u0027 +URIS[uri_index] + \u0027?resource=\u0027 + uri + address;\n}\n```\n\nIf the address is in the format of a user address (user@host.com), the host will be anything\nafter the first found @ symbol. Since no other test is done, an adversary may pass a specially\ncrafted address such as user@localhost:7000/admin/restricted_page? and reach pages that\nwould normally be out of reach. In this example, the code would treat\nlocalhost:7000/admin/restricted_page? as the host, and the created URL would be\nhttps://localhost:7000/admin/restricted_page?/.well-known/webfinger?resource=acct:use\nr@localhost:7000/admin/restricted_page?. A server listening on localhost:7000 will then\nparse the request as a GET request for the page /admin/restricted_page with the query string\n/.well-known/webfinger?resource=acct:user@localhost:7000/admin/restricted_page?.\n\n### PoC and Steps to reproduce\nThis PoC assumes that there is a server on the machine listening on port 3000, which receives\nrequests for WebFinger lookups on the address /api/v1/search_user, and then calls the lookup\nfunction in webfinger.js with the user passed as an argument. For the sake of the example we\nassume that the server configured webfinger.js with tls_only=false.\n\n\n1. Activate a local HTTP server listening to port 1234 with a \u201csecret.txt\u201d file:\n\n```\npython3 -m http.server 1234\n```\n\n2. Run the following command:\n\n```\ncurl\n\"http://localhost:3000/api/v1/search_user?search=user@localhost:1234/secret.txt\n?\"\n```\n\n3. View the console of the Python\u2019s HTTP server and see that a request for a\n\u201csecret.txt?/.well-known/webfinger?resource=acct:user@localhost:1234/secret.txt\n?\u201d file was performed.\nThis proves that we can redirect the URL to any domain and path we choose, including\nlocalhost and the internal LAN.\n\n\n### Impact\nDue to this issue, any user can cause a server using the library to send GET requests with\ncontrolled host, path and port in an attempt to query services running on the instance\u2019s host or\nlocal network, and attempt to execute a Blind-SSRF gadget in hope of targeting a known\nvulnerable local service running on the victim\u2019s machine.\n\n\n### References\nThe vulnerability was discovered by Ori Hollander of the JFrog Vulnerability Research team.",
  "id": "GHSA-8xq3-w9fx-74rv",
  "modified": "2025-08-01T18:36:22Z",
  "published": "2025-07-28T16:41:06Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/silverbucket/webfinger.js/security/advisories/GHSA-8xq3-w9fx-74rv"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54590"
    },
    {
      "type": "WEB",
      "url": "https://github.com/silverbucket/webfinger.js/commit/b5f2f2c957297d25f4d76072963fccaee2e3095a"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/silverbucket/webfinger.js"
    },
    {
      "type": "WEB",
      "url": "https://github.com/silverbucket/webfinger.js/releases/tag/v2.8.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "webfinger.js Blind SSRF Vulnerability"
}

GHSA-8XQM-6FJ2-HFGF

Vulnerability from github – Published: 2025-12-11 15:30 – Updated: 2025-12-11 17:01
VLAI
Summary
PowerJob has a server-side request forgery vulnerability in PingPongUtils.java
Details

A vulnerability was identified in PowerJob up to 5.1.2. This vulnerability affects the function checkConnectivity of the file src/main/java/tech/powerjob/common/utils/net/PingPongUtils.java of the component Network Request Handler. The manipulation of the argument targetIp/targetPort leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.

Severity
6.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "tech.powerjob:powerjob-common"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "5.1.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-14518"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-12-11T17:01:45Z",
    "nvd_published_at": "2025-12-11T15:15:47Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability was identified in PowerJob up to 5.1.2. This vulnerability affects the function checkConnectivity of the file src/main/java/tech/powerjob/common/utils/net/PingPongUtils.java of the component Network Request Handler. The manipulation of the argument targetIp/targetPort leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.",
  "id": "GHSA-8xqm-6fj2-hfgf",
  "modified": "2025-12-11T17:01:45Z",
  "published": "2025-12-11T15:30:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14518"
    },
    {
      "type": "WEB",
      "url": "https://github.com/PowerJob/PowerJob/issues/1144"
    },
    {
      "type": "WEB",
      "url": "https://github.com/PowerJob/PowerJob/issues/1144#issue-3673393002"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/PowerJob/PowerJob"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.335856"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.335856"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.702896"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": " PowerJob has a server-side request forgery vulnerability in PingPongUtils.java"
}

GHSA-8XWC-6H6P-HH69

Vulnerability from github – Published: 2023-04-16 00:30 – Updated: 2024-04-04 03:29
VLAI
Details

An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is Server-Side Request Forgery (SSRF) via a loopback address to the validate_localhost function in url_blocker.rb.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2018-17452"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-04-15T23:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is Server-Side Request Forgery (SSRF) via a loopback address to the validate_localhost function in url_blocker.rb.",
  "id": "GHSA-8xwc-6h6p-hh69",
  "modified": "2024-04-04T03:29:31Z",
  "published": "2023-04-16T00:30:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-17452"
    },
    {
      "type": "WEB",
      "url": "https://about.gitlab.com/blog/categories/releases"
    },
    {
      "type": "WEB",
      "url": "https://about.gitlab.com/releases/2018/10/01/security-release-gitlab-11-dot-3-dot-1-released"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-8XWH-HX55-JJPR

Vulnerability from github – Published: 2026-08-16 21:30 – Updated: 2026-08-16 21:30
VLAI
Details

A vulnerability has been found in gomarble-ai facebook-ads-mcp-server 0.1.0. The impacted element is the function fetch_pagination_url of the file server.py. Such manipulation leads to server-side request forgery. The attack can be launched remotely. The name of the patch is 4e53875aa22e8991c2fa4a7660d86e1caba66659. Applying a patch is advised to resolve this issue.

Severity
6.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-19956"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-16T21:16:37Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability has been found in gomarble-ai facebook-ads-mcp-server 0.1.0. The impacted element is the function fetch_pagination_url of the file server.py. Such manipulation leads to server-side request forgery. The attack can be launched remotely. The name of the patch is 4e53875aa22e8991c2fa4a7660d86e1caba66659. Applying a patch is advised to resolve this issue.",
  "id": "GHSA-8xwh-hx55-jjpr",
  "modified": "2026-08-16T21:30:40Z",
  "published": "2026-08-16T21:30:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19956"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gomarble-ai/facebook-ads-mcp-server/issues/29"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gomarble-ai/facebook-ads-mcp-server/pull/32"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gomarble-ai/facebook-ads-mcp-server/commit/4e53875aa22e8991c2fa4a7660d86e1caba66659"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gomarble-ai/facebook-ads-mcp-server"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/cve/CVE-2026-19956"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/submit/872772"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/391113"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/391113/cti"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-9282-M2C9-Q28W

Vulnerability from github – Published: 2025-03-11 15:30 – Updated: 2025-03-11 15:30
VLAI
Details

A vulnerability, which was classified as problematic, was found in Stoque Zeev.it 4.24. This affects an unknown part of the file /Login?inpLostSession=1 of the component Login Page. The manipulation of the argument inpRedirectURL leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-2192"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-03-11T13:15:43Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability, which was classified as problematic, was found in Stoque Zeev.it 4.24. This affects an unknown part of the file /Login?inpLostSession=1 of the component Login Page. The manipulation of the argument inpRedirectURL leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
  "id": "GHSA-9282-m2c9-q28w",
  "modified": "2025-03-11T15:30:59Z",
  "published": "2025-03-11T15:30:59Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2192"
    },
    {
      "type": "WEB",
      "url": "https://drive.google.com/file/d/17QAEbzVIjTUj8FDOVMwfl9-7j8LRcK4V/view?usp=sharing"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.299217"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.299217"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.511708"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

No mitigation information available for this CWE.

CAPEC-664: Server Side Request Forgery

An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.

← Back to the CWE list