CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
5865 vulnerabilities reference this CWE, most recent first.
GHSA-4966-5QV6-XGV5
Vulnerability from github – Published: 2026-07-23 12:32 – Updated: 2026-07-23 12:32Unauthenticated Server Side Request Forgery (SSRF) in PeproDev Ultimate Invoice <= 2.2.6 versions.
{
"affected": [],
"aliases": [
"CVE-2026-65516"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-23T12:18:44Z",
"severity": "HIGH"
},
"details": "Unauthenticated Server Side Request Forgery (SSRF) in PeproDev Ultimate Invoice \u003c= 2.2.6 versions.",
"id": "GHSA-4966-5qv6-xgv5",
"modified": "2026-07-23T12:32:29Z",
"published": "2026-07-23T12:32:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65516"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/pepro-ultimate-invoice/vulnerability/wordpress-peprodev-ultimate-invoice-plugin-2-2-6-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-497M-H4J2-C5X4
Vulnerability from github – Published: 2025-02-07 03:32 – Updated: 2025-02-07 03:32Server-Side Request Forgery (SSRF) in Microsoft Dynamics 365 Sales allows an authorized attacker to elevate privileges over a network.
{
"affected": [],
"aliases": [
"CVE-2025-21177"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-06T23:15:08Z",
"severity": "HIGH"
},
"details": "Server-Side Request Forgery (SSRF) in Microsoft Dynamics 365 Sales allows an authorized attacker to elevate privileges over a network.",
"id": "GHSA-497m-h4j2-c5x4",
"modified": "2025-02-07T03:32:02Z",
"published": "2025-02-07T03:32:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21177"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21177"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-49FF-FRJV-G5X5
Vulnerability from github – Published: 2026-06-26 15:32 – Updated: 2026-06-26 15:32Subscriber Server Side Request Forgery (SSRF) in Kirki <= 6.0.11 versions.
{
"affected": [],
"aliases": [
"CVE-2026-57627"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-26T15:16:50Z",
"severity": "MODERATE"
},
"details": "Subscriber Server Side Request Forgery (SSRF) in Kirki \u003c= 6.0.11 versions.",
"id": "GHSA-49ff-frjv-g5x5",
"modified": "2026-06-26T15:32:17Z",
"published": "2026-06-26T15:32:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57627"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/kirki/vulnerability/wordpress-kirki-plugin-6-0-11-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-49FM-88JX-9FHR
Vulnerability from github – Published: 2023-11-13 03:30 – Updated: 2026-04-28 21:33Server-Side Request Forgery (SSRF) vulnerability in WPChill Download Monitor.This issue affects Download Monitor: from n/a through 4.8.1.
{
"affected": [],
"aliases": [
"CVE-2023-31219"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-11-13T03:15:08Z",
"severity": "MODERATE"
},
"details": "Server-Side Request Forgery (SSRF) vulnerability in WPChill Download Monitor.This issue affects Download Monitor: from n/a through 4.8.1.",
"id": "GHSA-49fm-88jx-9fhr",
"modified": "2026-04-28T21:33:07Z",
"published": "2023-11-13T03:30:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-31219"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/download-monitor/wordpress-download-monitor-plugin-4-8-1-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-49J8-GCX6-2F92
Vulnerability from github – Published: 2026-09-16 06:31 – Updated: 2026-09-17 15:31The WP Import Export Lite WordPress plugin before 3.9.33 does not properly validate URLs before requesting them during the import process, allowing users with the import capability, which administrators hold by default, to make the site issue requests to internal hosts and services and read their responses. This is an incomplete fix for CVE-2026-11397.
{
"affected": [],
"aliases": [
"CVE-2026-76559"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-16T06:16:32Z",
"severity": "MODERATE"
},
"details": "The WP Import Export Lite WordPress plugin before 3.9.33 does not properly validate URLs before requesting them during the import process, allowing users with the import capability, which administrators hold by default, to make the site issue requests to internal hosts and services and read their responses. This is an incomplete fix for CVE-2026-11397.",
"id": "GHSA-49j8-gcx6-2f92",
"modified": "2026-09-17T15:31:54Z",
"published": "2026-09-16T06:31:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76559"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/62e27c51-95c7-407b-81aa-85757130adb9"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-4C2V-95CV-XVXM
Vulnerability from github – Published: 2026-04-29 12:33 – Updated: 2026-04-29 12:33Server-Side Request Forgery (SSRF) vulnerability in ILLID Share This Image share-this-image allows Server Side Request Forgery.This issue affects Share This Image: from n/a through <= 2.14.
{
"affected": [],
"aliases": [
"CVE-2026-42641"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-29T12:16:19Z",
"severity": "MODERATE"
},
"details": "Server-Side Request Forgery (SSRF) vulnerability in ILLID Share This Image share-this-image allows Server Side Request Forgery.This issue affects Share This Image: from n/a through \u003c= 2.14.",
"id": "GHSA-4c2v-95cv-xvxm",
"modified": "2026-04-29T12:33:08Z",
"published": "2026-04-29T12:33:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42641"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/share-this-image/vulnerability/wordpress-share-this-image-plugin-2-14-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-4C4X-JM2X-PF9J
Vulnerability from github – Published: 2026-01-22 18:41 – Updated: 2026-01-23 15:49Summary
/api/v1/index/retrieve supports retrieving a public key via a user-provided URL, allowing attackers to trigger SSRF to arbitrary internal services.
Since the SSRF only can trigger GET requests, the request cannot mutate state. The response from the GET request is not returned to the caller so data exfiltration is not possible. A malicious actor could attempt to probe an internal network through Blind SSRF.
Impact
- SSRF to cloud metadata (169.254.169.254)
- SSRF to internal Kubernetes APIs
- SSRF to any service accessible from Fulcio's network
Patches
Upgrade to v1.5.0. Note that this is a breaking change to the search API and fully disables lookups by URL. If you require this feature, please reach out and we can discuss alternatives.
Workarounds
Disable the search endpoint with --enable_retrieve_api=false.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.4.3"
},
"package": {
"ecosystem": "Go",
"name": "github.com/sigstore/rekor"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-24117"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-01-22T18:41:26Z",
"nvd_published_at": "2026-01-22T22:16:21Z",
"severity": "MODERATE"
},
"details": "## Summary\n\n`/api/v1/index/retrieve` supports retrieving a public key via a user-provided URL, allowing attackers to trigger SSRF to arbitrary internal services.\n\nSince the SSRF only can trigger GET requests, the request cannot mutate state. The response from the GET request is not returned to the caller so data exfiltration is not possible. A malicious actor could attempt to probe an internal network through [Blind SSRF](https://portswigger.net/web-security/ssrf/blind).\n\n## Impact\n\n* SSRF to cloud metadata (169.254.169.254)\n* SSRF to internal Kubernetes APIs\n* SSRF to any service accessible from Fulcio\u0027s network\n\n## Patches\n\nUpgrade to v1.5.0. Note that this is a breaking change to the search API and fully disables lookups by URL. If you require this feature, please reach out and we can discuss alternatives.\n\n## Workarounds\n\nDisable the search endpoint with `--enable_retrieve_api=false`.",
"id": "GHSA-4c4x-jm2x-pf9j",
"modified": "2026-01-23T15:49:13Z",
"published": "2026-01-22T18:41:26Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/sigstore/rekor/security/advisories/GHSA-4c4x-jm2x-pf9j"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24117"
},
{
"type": "WEB",
"url": "https://github.com/sigstore/rekor/commit/60ef2bceba192c5bf9327d003bceea8bf1f8275f"
},
{
"type": "PACKAGE",
"url": "https://github.com/sigstore/rekor"
},
{
"type": "WEB",
"url": "https://github.com/sigstore/rekor/releases/tag/v1.5.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Rekor affected by Server-Side Request Forgery (SSRF) via provided public key URL"
}
GHSA-4C5C-RJ4Q-XM5W
Vulnerability from github – Published: 2022-04-01 00:00 – Updated: 2022-04-07 00:00MashZone NextGen through 10.7 GA has an SSRF vulnerability that allows an attacker to interact with arbitrary TCP services, by abusing the feature to check the availability of a PPM connection. This occurs in com.idsscheer.ppmmashup.web.webservice.impl.ZPrestoAdminWebService.
{
"affected": [],
"aliases": [
"CVE-2021-33581"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-03-30T22:15:00Z",
"severity": "HIGH"
},
"details": "MashZone NextGen through 10.7 GA has an SSRF vulnerability that allows an attacker to interact with arbitrary TCP services, by abusing the feature to check the availability of a PPM connection. This occurs in com.idsscheer.ppmmashup.web.webservice.impl.ZPrestoAdminWebService.",
"id": "GHSA-4c5c-rj4q-xm5w",
"modified": "2022-04-07T00:00:28Z",
"published": "2022-04-01T00:00:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33581"
},
{
"type": "WEB",
"url": "https://github.com/blackarrowsec/advisories/tree/master/2021/CVE-2021-33581"
},
{
"type": "WEB",
"url": "https://www.softwareag.com/corporate/products/az/mashzone_nextgen/default"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4CC2-G9W2-FHF6
Vulnerability from github – Published: 2026-06-19 22:10 – Updated: 2026-06-19 22:10Summary
When parsing a WSDL or XSD document, python-zeep follows transitive references — xsd:import, xsd:include, wsdl:import, and lxml entity/DTD resolution — and will fetch http/https URLs found in those references. The Settings.forbid_external option, intended to disable this transitive remote fetching, was defined but not wired to any logic from version 4.0.0 through 4.3.2 (a regression introduced when zeep moved off defusedxml in 4.0). As a result, setting forbid_external=True had no effect, and applications that processed untrusted or attacker-influenced WSDL/XSD documents could be coerced into making server-side requests to arbitrary URLs (SSRF).
Impact
Server-Side Request Forgery (SSRF), CWE-918.
An attacker who can supply or influence the contents of a WSDL/XSD that an application loads with zeep can embed an import/include reference (e.g. <xsd:import schemaLocation="http://169.254.169.254/...">) pointing at an internal or otherwise sensitive endpoint. When zeep parses the document it transitively fetches that URL using the configured transport, causing the application to issue outbound requests to attacker-chosen destinations. This can be used to reach internal-only services, cloud metadata endpoints, or other hosts not directly reachable by the attacker, and may disclose response timing/behaviour.
Impacted users are those who:
- load WSDL/XSD documents that are untrusted or whose import targets an attacker can control, and/or
- relied on
forbid_external=Trueas a security control — in 4.0.0–4.3.2 that setting silently did nothing, so the protection users believed they had was not in effect.
Note the default was (and remains) forbid_external=False, i.e. transitive remote fetching is permitted by default; the security defect is specifically that the opt-out control was non-functional.
Patches
Fixed in python-zeep 4.3.3. The forbid_external setting is now enforced: when set to True, zeep refuses to transitively fetch http/https resources via xsd:import, xsd:include, wsdl:import, or lxml entity/DTD resolution, raising zeep.exceptions.ExternalReferenceForbidden. The user-supplied entry-point WSDL/schema URL is still loaded.
Affected versions: >= 4.0.0, < 4.3.3.
Upgrade to 4.3.3 (or later) and set forbid_external=True when loading documents from untrusted sources:
from zeep import Client, Settings
settings = Settings(forbid_external=True)
client = Client("https://untrusted.example/service?wsdl", settings=settings)
Workarounds
If you cannot upgrade to 4.3.3:
- Do not load untrusted WSDL/XSD documents, and avoid loading WSDLs whose import/include targets can be influenced by untrusted input.
- Vendor the schema locally: pre-fetch and review the WSDL and all of its imported schemas, then load them from local files (e.g. file:// paths) so no remote fetching occurs at parse time.
- Restrict egress at the network layer: block outbound traffic from the host/process to internal ranges and metadata endpoints (e.g. 169.254.169.254, RFC1918 ranges) so SSRF attempts cannot reach sensitive targets.
- Use a restrictive custom Transport: subclass the zeep transport and reject/allow-list URLs in load() so disallowed hosts are never fetched.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "zeep"
},
"ranges": [
{
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.3.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-19T22:10:26Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "## Summary\n\nWhen parsing a WSDL or XSD document, python-zeep follows transitive references \u2014 xsd:import, xsd:include, wsdl:import, and lxml entity/DTD resolution \u2014 and will fetch http/https URLs found in those references. The Settings.forbid_external option, intended to disable this transitive remote fetching, was defined but not wired to any logic from version 4.0.0 through 4.3.2 (a regression introduced when zeep moved off defusedxml in 4.0). As a result, setting `forbid_external=True` had no effect, and applications that processed untrusted or attacker-influenced WSDL/XSD documents could be coerced into making server-side requests to arbitrary URLs (SSRF).\n\n## Impact\n\nServer-Side Request Forgery (SSRF), CWE-918.\n\nAn attacker who can supply or influence the contents of a WSDL/XSD that an application loads with zeep can embed an import/include reference (e.g. `\u003cxsd:import schemaLocation=\"http://169.254.169.254/...\"\u003e`) pointing at an internal or otherwise sensitive endpoint. When zeep parses the document it transitively fetches that URL using the configured transport, causing the application to issue outbound requests to attacker-chosen destinations. This can be used to reach internal-only services, cloud metadata endpoints, or other hosts not directly reachable by the attacker, and may disclose response timing/behaviour.\n\nImpacted users are those who:\n\n- load WSDL/XSD documents that are untrusted or whose import targets an attacker can control, and/or\n- relied on `forbid_external=True` as a security control \u2014 in 4.0.0\u20134.3.2 that setting silently did nothing, so the protection users believed they had was not in effect.\n\nNote the default was (and remains) `forbid_external=False`, i.e. transitive remote fetching is permitted by default; the security defect is specifically that the opt-out control was non-functional.\n\n## Patches\n\nFixed in python-zeep 4.3.3. The forbid_external setting is now enforced: when set to True, zeep refuses to transitively fetch http/https resources via `xsd:import`, `xsd:include`, `wsdl:import`, or lxml entity/DTD resolution, raising `zeep.exceptions.ExternalReferenceForbidden`. The user-supplied entry-point WSDL/schema URL is still loaded.\n\nAffected versions: \u003e= 4.0.0, \u003c 4.3.3.\n\nUpgrade to 4.3.3 (or later) and set forbid_external=True when loading documents from untrusted sources:\n\n```python\nfrom zeep import Client, Settings\n\nsettings = Settings(forbid_external=True)\nclient = Client(\"https://untrusted.example/service?wsdl\", settings=settings)\n```\n\n## Workarounds\n\nIf you cannot upgrade to 4.3.3:\n\n- Do not load untrusted WSDL/XSD documents, and avoid loading WSDLs whose import/include targets can be influenced by untrusted input.\n- Vendor the schema locally: pre-fetch and review the WSDL and all of its imported schemas, then load them from local files (e.g. file:// paths) so no remote fetching occurs at parse\n time.\n- Restrict egress at the network layer: block outbound traffic from the host/process to internal ranges and metadata endpoints (e.g. 169.254.169.254, RFC1918 ranges) so SSRF attempts\n cannot reach sensitive targets.\n- Use a restrictive custom Transport: subclass the zeep transport and reject/allow-list URLs in load() so disallowed hosts are never fetched.",
"id": "GHSA-4cc2-g9w2-fhf6",
"modified": "2026-06-19T22:10:26Z",
"published": "2026-06-19T22:10:26Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/mvantellingen/python-zeep/security/advisories/GHSA-4cc2-g9w2-fhf6"
},
{
"type": "WEB",
"url": "https://github.com/mvantellingen/python-zeep/commit/83eb07bc6c84d841329d4f88856fecdba86f753e"
},
{
"type": "PACKAGE",
"url": "https://github.com/mvantellingen/python-zeep"
},
{
"type": "WEB",
"url": "https://github.com/mvantellingen/python-zeep/releases/tag/4.3.3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Zeep: Server-Side Request Forgery (SSRF)"
}
GHSA-4CCH-WXPW-8P28
Vulnerability from github – Published: 2020-12-21 16:28 – Updated: 2025-01-15 21:31Impact
The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream.
Patches
If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15.
Workarounds
The reported vulnerability does not exist running Java 15 or higher.
No user is affected, who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability.
Users of XStream 1.4.14 or below who still insist to use XStream default blacklist - despite that clear recommendation - can use a workaround depending on their version in use.
Users of XStream 1.4.14 can simply add two lines to XStream's setup code:
xstream.denyTypes(new String[]{ "jdk.nashorn.internal.objects.NativeString" });
xstream.denyTypesByRegExp(new String[]{ ".*\\.ReadAllStream\\$FileStream" });
Users of XStream 1.4.14 to 1.4.13 can simply add three lines to XStream's setup code:
xstream.denyTypes(new String[]{ "javax.imageio.ImageIO$ContainsFilter", "jdk.nashorn.internal.objects.NativeString" });
xstream.denyTypes(new Class[]{ java.lang.ProcessBuilder.class });
xstream.denyTypesByRegExp(new String[]{ ".*\\.ReadAllStream\\$FileStream" });
Users of XStream 1.4.12 to 1.4.7 who want to use XStream with a black list will have to setup such a list from scratch and deny at least the following types: javax.imageio.ImageIO$ContainsFilter, java.beans.EventHandler, java.lang.ProcessBuilder, jdk.nashorn.internal.objects.NativeString.class, java.lang.Void and void and deny several types by name pattern.
xstream.denyTypes(new String[]{ "javax.imageio.ImageIO$ContainsFilter", "jdk.nashorn.internal.objects.NativeString" });
xstream.denyTypes(new Class[]{ java.lang.ProcessBuilder.class, "jdk.nashorn.internal.objects.NativeString", java.beans.EventHandler.class, java.lang.ProcessBuilder.class, java.lang.Void.class, void.class });
xstream.denyTypesByRegExp(new String[]{ ".*\\$LazyIterator", "javax\\.crypto\\..*", ".*\\.ReadAllStream\\$FileStream" });
Users of XStream 1.4.6 or below can register an own converter to prevent the unmarshalling of the currently know critical types of the Java runtime. It is in fact an updated version of the workaround for CVE-2013-7285:
xstream.registerConverter(new Converter() {
public boolean canConvert(Class type) {
return type != null && (type == java.beans.EventHandler.class || type == java.lang.ProcessBuilder.class
|| type.getName().equals("javax.imageio.ImageIO$ContainsFilter") || type.getName().equals("jdk.nashorn.internal.objects.NativeString")
|| type == java.lang.Void.class || void.class || Proxy.isProxy(type))
|| type.getName().startsWith("javax.crypto.") || type.getName().endsWith("$LazyIterator") || type.getName().endsWith(".ReadAllStream$FileStream"));
}
public Object unmarshal(HierarchicalStreamReader reader, UnmarshallingContext context) {
throw new ConversionException("Unsupported type due to security reasons.");
}
public void marshal(Object source, HierarchicalStreamWriter writer, MarshallingContext context) {
throw new ConversionException("Unsupported type due to security reasons.");
}
}, XStream.PRIORITY_LOW);
For more information
If you have any questions or comments about this advisory: * Open an issue in XStream * Contact us at XStream Google Group
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.thoughtworks.xstream:xstream"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.4.15"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-26258"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2020-12-21T16:21:34Z",
"nvd_published_at": "2020-12-16T01:15:00Z",
"severity": "MODERATE"
},
"details": "### Impact\nThe vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream.\n\n### Patches\nIf you rely on XStream\u0027s default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.15.\n\n### Workarounds\nThe reported vulnerability does not exist running Java 15 or higher.\n\nNo user is affected, who followed the recommendation to setup XStream\u0027s Security Framework with a whitelist! Anyone relying on XStream\u0027s default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability.\n\nUsers of XStream 1.4.14 or below who still insist to use XStream default blacklist - despite that clear recommendation - can use a workaround depending on their version in use.\n\nUsers of XStream 1.4.14 can simply add two lines to XStream\u0027s setup code:\n```Java\nxstream.denyTypes(new String[]{ \"jdk.nashorn.internal.objects.NativeString\" });\nxstream.denyTypesByRegExp(new String[]{ \".*\\\\.ReadAllStream\\\\$FileStream\" });\n```\n\nUsers of XStream 1.4.14 to 1.4.13 can simply add three lines to XStream\u0027s setup code:\n```Java\nxstream.denyTypes(new String[]{ \"javax.imageio.ImageIO$ContainsFilter\", \"jdk.nashorn.internal.objects.NativeString\" });\nxstream.denyTypes(new Class[]{ java.lang.ProcessBuilder.class });\nxstream.denyTypesByRegExp(new String[]{ \".*\\\\.ReadAllStream\\\\$FileStream\" });\n```\nUsers of XStream 1.4.12 to 1.4.7 who want to use XStream with a black list will have to setup such a list from scratch and deny at least the following types: _javax.imageio.ImageIO$ContainsFilter_, _java.beans.EventHandler_, _java.lang.ProcessBuilder_, _jdk.nashorn.internal.objects.NativeString.class_, _java.lang.Void_ and _void_ and deny several types by name pattern.\n```Java\nxstream.denyTypes(new String[]{ \"javax.imageio.ImageIO$ContainsFilter\", \"jdk.nashorn.internal.objects.NativeString\" });\nxstream.denyTypes(new Class[]{ java.lang.ProcessBuilder.class, \"jdk.nashorn.internal.objects.NativeString\", java.beans.EventHandler.class, java.lang.ProcessBuilder.class, java.lang.Void.class, void.class });\nxstream.denyTypesByRegExp(new String[]{ \".*\\\\$LazyIterator\", \"javax\\\\.crypto\\\\..*\", \".*\\\\.ReadAllStream\\\\$FileStream\" });\n```\nUsers of XStream 1.4.6 or below can register an own converter to prevent the unmarshalling of the currently know critical types of the Java runtime. It is in fact an updated version of the workaround for CVE-2013-7285:\n```Java\nxstream.registerConverter(new Converter() {\n public boolean canConvert(Class type) {\n return type != null \u0026\u0026 (type == java.beans.EventHandler.class || type == java.lang.ProcessBuilder.class\n || type.getName().equals(\"javax.imageio.ImageIO$ContainsFilter\") || type.getName().equals(\"jdk.nashorn.internal.objects.NativeString\")\n || type == java.lang.Void.class || void.class || Proxy.isProxy(type))\n || type.getName().startsWith(\"javax.crypto.\") || type.getName().endsWith(\"$LazyIterator\") || type.getName().endsWith(\".ReadAllStream$FileStream\"));\n }\n\n public Object unmarshal(HierarchicalStreamReader reader, UnmarshallingContext context) {\n throw new ConversionException(\"Unsupported type due to security reasons.\");\n }\n\n public void marshal(Object source, HierarchicalStreamWriter writer, MarshallingContext context) {\n throw new ConversionException(\"Unsupported type due to security reasons.\");\n }\n}, XStream.PRIORITY_LOW);\n```\n \n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [XStream](https://github.com/x-stream/xstream/issues)\n* Contact us at [XStream Google Group](https://groups.google.com/group/xstream-user)",
"id": "GHSA-4cch-wxpw-8p28",
"modified": "2025-01-15T21:31:38Z",
"published": "2020-12-21T16:28:42Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/x-stream/xstream/security/advisories/GHSA-4cch-wxpw-8p28"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-26258"
},
{
"type": "PACKAGE",
"url": "https://github.com/x-stream/xstream"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r97993e3d78e1f5389b7b172ba9f308440830ce5f051ee62714a0aa34%40%3Ccommits.struts.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r97993e3d78e1f5389b7b172ba9f308440830ce5f051ee62714a0aa34@%3Ccommits.struts.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2020/12/msg00042.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20210409-0005"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2021/dsa-4828"
},
{
"type": "WEB",
"url": "https://x-stream.github.io/CVE-2020-26258.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Server-Side Forgery Request can be activated unmarshalling with XStream"
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.