Common Weakness Enumeration

CWE-918

Allowed

Server-Side Request Forgery (SSRF)

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

4734 vulnerabilities reference this CWE, most recent first.

GHSA-J3RG-3RGM-537H

Vulnerability from github – Published: 2023-03-03 23:07 – Updated: 2023-03-06 01:44
VLAI
Summary
Directus vulnerable to Server-Side Request Forgery On File Import
Details

Summary

Directus versions <=9.22.4 is vulnerable to Server-Side Request Forgery (SSRF) when importing a file from a remote web server (POST to /files/import). An attacker can bypass the security controls that were implemented to patch vulnerability CVE-2022-23080 by performing a DNS rebinding attack and view sensitive data from internal servers or perform a local port scan (eg. can access internal metadata API for AWS at http://169.254.169.254 event if 169.254.169.254 is in the deny IP list).

Details

DNS rebinding attacks work by running a DNS name server that resolves two different IP addresses when a domain is resolved simultaneously. This type of attack can be exploited to bypass the IP address deny list validation that was added to /api/src/services/file.ts for the function importOne to mitigate the previous SSRF vulnerability CVE-2022-23080. The validation in /api/src/services/file.ts first checks if the resolved IP address for a domain name does not a resolve to an IP address in the deny list:

let ip = resolvedUrl.hostname;

if (net.isIP(ip) === 0) {
    try {
        ip = (await lookupDNS(ip)).address;
    } catch (err: any) {
        logger.warn(err, `Couldn't lookup the DNS for url ${importURL}`);
        throw new ServiceUnavailableException(`Couldn't fetch file from url "${importURL}"`, {
            service: 'external-file',
        });
    }
}

if (env.IMPORT_IP_DENY_LIST.includes('0.0.0.0')) {
    const networkInterfaces = os.networkInterfaces();

    for (const networkInfo of Object.values(networkInterfaces)) {
        if (!networkInfo) continue;

        for (const info of networkInfo) {
            if (info.address === ip) {
                logger.warn(`Requested URL ${importURL} resolves to localhost.`);
                throw new ServiceUnavailableException(`Couldn't fetch file from url "${importURL}"`, {
                    service: 'external-file',
                });
            }
        }
    }
}

if (env.IMPORT_IP_DENY_LIST.includes(ip)) {
    logger.warn(`Requested URL ${importURL} resolves to a denied IP address.`);
    throw new ServiceUnavailableException(`Couldn't fetch file from url "${importURL}"`, {
        service: 'external-file',
    });
}

Once it validates that the resolved IP address is not in the deny list, then it uses axios to GET the url and saves the response content.

try {
    fileResponse = await axios.get<Readable>(encodeURL(importURL), {
        responseType: 'stream',
    });
} catch (err: any) {
    logger.warn(err, `Couldn't fetch file from url "${importURL}"`);
    throw new ServiceUnavailableException(`Couldn't fetch file from url "${importURL}"`, {
        service: 'external-file',
    });
}

However, this validation check and fetching the web resource causes to DNS queries that enable a DNS rebinding attack. On the first DNS query, an attacker controlled name server can be configured to resolve to an external IP address that is not in the deny list to bypass the validation. Then when axios is called, the name server resolves the domain name to a local IP address.

PoC

To demonstrate we will be using an online tool named rebinder. Rebinder randomly changes the IP address it resolves to depending on the subdomain. For an example, 7f000001.8efa468e.rbndr.us can resolve to either 142.250.70.142 (google.com) or 127.0.0.1. Sending multiple POST requests to /files/import using this domain will eventually cause a resolution to 142.250.70.142 first to bypass the validation then fetch the sensitive from an internal server when axios is called.

The following screenshots show what it looks like when a successful attack occurs.

Downloading a file named secret.txt from a webserver running from http://127.0.0.1/secret.txt image

Receiving the request from the internal server. Note that the incoming connection is from 127.0.0.1. image

After downloading the file it leaks the content of the secret file. image

Impact

An attacker can exploit this vulnerability to access highly sensitive internal server and steal sensitive information. An example is on Cloud Environments that utilise internal APIs for managing machine and privileges. For an example, if directus is hosted on AWS EC2 instance and has an IAM role assigned to the EC2 instance then an attacker can exploit this vulnerability to steal the AWS access keys to impersonate the EC2 instance using the AWS API.

Severity
5.0 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "directus"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9.23.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-26492"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-03-03T23:07:35Z",
    "nvd_published_at": "2023-03-03T22:15:00Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\nDirectus versions \u003c=9.22.4 is vulnerable to Server-Side Request Forgery (SSRF) when importing a file from a remote web server (POST to `/files/import`). An attacker can bypass the security controls that were implemented to patch vulnerability [CVE-2022-23080](https://security.snyk.io/vuln/SNYK-JS-DIRECTUS-2934713) by performing a [DNS rebinding attack](https://en.wikipedia.org/wiki/DNS_rebinding) and view sensitive data from internal servers or perform a local port scan (eg. can access internal metadata API for AWS at `http://169.254.169.254` event if `169.254.169.254` is in the deny IP list).\n\n### Details\nDNS rebinding attacks work by running a DNS name server that resolves two different IP addresses when a domain is resolved simultaneously. This type of attack can be exploited to bypass the IP address deny list validation that was added to [`/api/src/services/file.ts`](https://github.com/directus/directus/blob/main/api/src/services/files.ts) for the function `importOne` to mitigate the previous SSRF vulnerability [CVE-2022-23080](https://security.snyk.io/vuln/SNYK-JS-DIRECTUS-2934713). The validation in [`/api/src/services/file.ts`](https://github.com/directus/directus/blob/main/api/src/services/files.ts) first checks if the resolved IP address for a domain name does not a resolve to an IP address in the deny list:\n\n```js\nlet ip = resolvedUrl.hostname;\n\nif (net.isIP(ip) === 0) {\n    try {\n        ip = (await lookupDNS(ip)).address;\n    } catch (err: any) {\n        logger.warn(err, `Couldn\u0027t lookup the DNS for url ${importURL}`);\n        throw new ServiceUnavailableException(`Couldn\u0027t fetch file from url \"${importURL}\"`, {\n            service: \u0027external-file\u0027,\n        });\n    }\n}\n\nif (env.IMPORT_IP_DENY_LIST.includes(\u00270.0.0.0\u0027)) {\n    const networkInterfaces = os.networkInterfaces();\n\n    for (const networkInfo of Object.values(networkInterfaces)) {\n        if (!networkInfo) continue;\n\n        for (const info of networkInfo) {\n            if (info.address === ip) {\n                logger.warn(`Requested URL ${importURL} resolves to localhost.`);\n                throw new ServiceUnavailableException(`Couldn\u0027t fetch file from url \"${importURL}\"`, {\n                    service: \u0027external-file\u0027,\n                });\n            }\n        }\n    }\n}\n\nif (env.IMPORT_IP_DENY_LIST.includes(ip)) {\n    logger.warn(`Requested URL ${importURL} resolves to a denied IP address.`);\n    throw new ServiceUnavailableException(`Couldn\u0027t fetch file from url \"${importURL}\"`, {\n        service: \u0027external-file\u0027,\n    });\n}\n```\n\nOnce it validates that the resolved IP address is not in the deny list, then it uses `axios` to `GET` the url and saves the response content.\n\n```js\ntry {\n    fileResponse = await axios.get\u003cReadable\u003e(encodeURL(importURL), {\n        responseType: \u0027stream\u0027,\n    });\n} catch (err: any) {\n    logger.warn(err, `Couldn\u0027t fetch file from url \"${importURL}\"`);\n    throw new ServiceUnavailableException(`Couldn\u0027t fetch file from url \"${importURL}\"`, {\n        service: \u0027external-file\u0027,\n    });\n}\n```\n\nHowever, this validation check and fetching the web resource causes to DNS queries that enable a DNS rebinding attack. On the first DNS query, an attacker controlled name server can be configured to resolve to an external IP address that is not in the deny list to bypass the validation. Then when `axios` is called, the name server resolves the domain name to a local IP address.\n\n### PoC\nTo demonstrate we will be using an online tool named [rebinder](https://lock.cmpxchg8b.com/rebinder.html). Rebinder randomly changes the IP address it resolves to depending on the subdomain. For an example, `7f000001.8efa468e.rbndr.us` can resolve to either `142.250.70.142` (google.com) or **`127.0.0.1`**. Sending multiple `POST` requests to `/files/import` using this domain will eventually cause a resolution to `142.250.70.142` first to bypass the validation then fetch the sensitive from an internal server when `axios` is called.\n\nThe following screenshots show what it looks like when a successful attack occurs.\n\n*Downloading a file named `secret.txt` from a webserver running from `http://127.0.0.1/secret.txt`*\n![image](https://user-images.githubusercontent.com/6276577/218124035-26f7f0c3-47b3-424d-b4d4-bd3b47161983.png)\n\n*Receiving the request from the internal server. Note that the incoming connection is from **127.0.0.1**.*\n![image](https://user-images.githubusercontent.com/6276577/218124119-87b8d5d6-934d-4e07-be4d-066616a9a435.png)\n\n*After downloading the file it leaks the content of the secret file.*\n![image](https://user-images.githubusercontent.com/6276577/218122210-87b2e478-1081-4830-a9ea-e5d9f39bb129.png)\n\n### Impact\nAn attacker can exploit this vulnerability to access highly sensitive internal server and steal sensitive information. An example is on Cloud Environments that utilise internal APIs for managing machine and privileges. For an example, if `directus` is hosted on AWS EC2 instance and has an IAM role assigned to the EC2 instance then an attacker can exploit this vulnerability to steal the AWS access keys to impersonate the EC2 instance using the AWS API.\n",
  "id": "GHSA-j3rg-3rgm-537h",
  "modified": "2023-03-06T01:44:06Z",
  "published": "2023-03-03T23:07:35Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/directus/directus/security/advisories/GHSA-j3rg-3rgm-537h"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26492"
    },
    {
      "type": "WEB",
      "url": "https://github.com/directus/directus/commit/ff53d3e69a602d05342e15d9bb616884833ddbff"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/directus/directus"
    },
    {
      "type": "WEB",
      "url": "https://github.com/directus/directus/releases/tag/v9.23.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Directus vulnerable to Server-Side Request Forgery On File Import"
}

GHSA-J3RP-FV9F-6V63

Vulnerability from github – Published: 2025-11-21 00:30 – Updated: 2025-11-21 00:30
VLAI
Details

Azure Monitor Elevation of Privilege Vulnerability

Severity
8.6 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-62207"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-11-20T23:15:55Z",
    "severity": "HIGH"
  },
  "details": "Azure Monitor Elevation of Privilege Vulnerability",
  "id": "GHSA-j3rp-fv9f-6v63",
  "modified": "2025-11-21T00:30:22Z",
  "published": "2025-11-21T00:30:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62207"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62207"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-J429-5XWX-MJX2

Vulnerability from github – Published: 2025-09-22 21:30 – Updated: 2025-09-22 21:30
VLAI
Details

A security flaw has been discovered in SeriaWei ZKEACMS up to 4.3. This vulnerability affects the function CheckPage/Suggestions in the library cms-v4.3\wwwroot\Plugins\ZKEACMS.SEOSuggestions\ZKEACMS.SEOSuggestions.dll of the component SEOSuggestions. Performing manipulation results in server-side request forgery. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.

Severity
4.7 (Medium)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
2.0 (Low)
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-10765"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-21T07:15:35Z",
    "severity": "MODERATE"
  },
  "details": "A security flaw has been discovered in SeriaWei ZKEACMS up to 4.3. This vulnerability affects the function CheckPage/Suggestions in the library cms-v4.3\\wwwroot\\Plugins\\ZKEACMS.SEOSuggestions\\ZKEACMS.SEOSuggestions.dll of the component SEOSuggestions. Performing manipulation results in server-side request forgery. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.",
  "id": "GHSA-j429-5xwx-mjx2",
  "modified": "2025-09-22T21:30:19Z",
  "published": "2025-09-22T21:30:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10765"
    },
    {
      "type": "WEB",
      "url": "https://github.com/wooyun123/wooyun/issues/1"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.325120"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.325120"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.647952"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-J42X-RXGC-89XM

Vulnerability from github – Published: 2025-09-12 06:30 – Updated: 2025-09-12 06:30
VLAI
Details

An issue has been discovered in GitLab CE/EE affecting all versions from 16.11 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that could have allowed authenticated users to make unintended internal requests through proxy environments by injecting crafted sequences.

Severity
8.5 (High)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-6454"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-12T06:15:42Z",
    "severity": "HIGH"
  },
  "details": "An issue has been discovered in GitLab CE/EE affecting all versions from 16.11 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that could have allowed authenticated users to make unintended internal requests through proxy environments by injecting crafted sequences.",
  "id": "GHSA-j42x-rxgc-89xm",
  "modified": "2025-09-12T06:30:26Z",
  "published": "2025-09-12T06:30:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6454"
    },
    {
      "type": "WEB",
      "url": "https://hackerone.com/reports/3162711"
    },
    {
      "type": "WEB",
      "url": "https://about.gitlab.com/releases/2025/09/10/patch-release-gitlab-18-3-2-released"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/550766"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-J432-4W3J-3W8J

Vulnerability from github – Published: 2026-04-14 23:22 – Updated: 2026-04-24 20:41
VLAI
Summary
WWBN AVideo has a SSRF via same-domain hostname with alternate port bypasses isSSRFSafeURL
Details

Summary

The isSSRFSafeURL() function in objects/functions.php contains a same-domain shortcircuit (lines 4290-4296) that allows any URL whose hostname matches webSiteRootURL to bypass all SSRF protections. Because the check compares only the hostname and ignores the port, an attacker can reach arbitrary ports on the AVideo server by using the site's public hostname with a non-standard port. The response body is saved to a web-accessible path, enabling full exfiltration.

Details

Commit 40872e529 fixed an extension-based SSRF bypass by making isSSRFSafeURL() unconditional. However, isSSRFSafeURL() itself contains a same-domain shortcircuit that returns true when the URL's hostname matches webSiteRootURL's hostname, without validating the port:

// objects/functions.php:4290-4296
if (!empty($global['webSiteRootURL'])) {
    $siteHost = strtolower(parse_url($global['webSiteRootURL'], PHP_URL_HOST));
    if ($host === $siteHost) {
        _error_log("isSSRFSafeURL: allowing same-domain request to {$host} (matches webSiteRootURL)");
        return true;  // Returns immediately — port, path, scheme all unchecked
    }
}

The attack flow through objects/aVideoEncoder.json.php:

  1. User-supplied $_REQUEST['downloadURL'] is passed to downloadVideoFromDownloadURL() at line 166
  2. isSSRFSafeURL() is called at line 368 — passes due to hostname match
  3. url_get_contents($downloadURL) fetches the attacker-controlled URL at line 378
  4. Response is written to Video::getStoragePath() . "cache/tmpFile/" . basename($downloadURL) at line 393-395

The cache/tmpFile/ directory is under the web-accessible videos storage path. The attacker can retrieve the file to exfiltrate the internal service response.

The auth requirement is User::canUpload() (line 59), which is satisfied by any authenticated user with upload permission. Alternatively, a valid video_id_hash (a per-video token) can be used via useVideoHashOrLogin() at line 57.

PoC

Assuming the AVideo instance is at https://avideo.example.com/ and an internal service runs on port 9998:

# Step 1: Authenticate and get cookies (any user with upload permission)
curl -c cookies.txt -X POST 'https://avideo.example.com/objects/login.json.php' \
  -d 'user=testuser&pass=testpass'

# Step 2: Send SSRF request targeting port 9998 on the same host
# The hostname matches webSiteRootURL so isSSRFSafeURL() returns true
curl -b cookies.txt -X POST 'https://avideo.example.com/objects/aVideoEncoder.json.php' \
  -d 'format=mp4&downloadURL=http://avideo.example.com:9998/large-internal-endpoint.mp4&videos_id=1&first_request=1'

# Step 3: Retrieve the exfiltrated response
# The file is saved to cache/tmpFile/ with the basename of the URL
curl 'https://avideo.example.com/videos/cache/tmpFile/large-internal-endpoint.mp4' -o response.bin

Note: The internal service response must be >= 20KB (or >= 5KB if the URL ends in .mp3) to pass the size check at line 384. For smaller responses, the attacker can target endpoints that return verbose output or append padding parameters.

The fix at 40872e529 specifically mentions blocking http://127.0.0.1:9998/probe.mp4. This bypass reaches the exact same internal service by replacing 127.0.0.1 with the site's public hostname — the DNS resolution points to the same server.

Impact

  • Internal service access: An authenticated attacker can reach any TCP port on the AVideo server that speaks HTTP, including databases with HTTP interfaces, monitoring endpoints, admin panels, cloud metadata services (if the hostname resolves to a cloud instance), and other co-hosted services.
  • Data exfiltration: Response bodies are written to a web-accessible directory, allowing the attacker to retrieve internal service responses.
  • Scope change: The vulnerability crosses from the AVideo application into other services on the same host, justifying S:C in CVSS scoring.
  • Bypass of existing fix: This directly circumvents the SSRF protection added in commit 40872e529.

Recommended Fix

The same-domain shortcircuit should validate that both the hostname and port match webSiteRootURL. Replace objects/functions.php lines 4290-4296:

// Allow same-domain requests ONLY if hostname AND port match webSiteRootURL
if (!empty($global['webSiteRootURL'])) {
    $siteHost = strtolower(parse_url($global['webSiteRootURL'], PHP_URL_HOST));
    $sitePort = parse_url($global['webSiteRootURL'], PHP_URL_PORT);
    $siteScheme = strtolower(parse_url($global['webSiteRootURL'], PHP_URL_SCHEME));
    // Default port based on scheme if not explicitly set
    if (empty($sitePort)) {
        $sitePort = ($siteScheme === 'https') ? 443 : 80;
    }

    $urlPort = parse_url($url, PHP_URL_PORT);
    $urlScheme = strtolower(parse_url($url, PHP_URL_SCHEME));
    if (empty($urlPort)) {
        $urlPort = ($urlScheme === 'https') ? 443 : 80;
    }

    if ($host === $siteHost && $urlPort === $sitePort) {
        _error_log("isSSRFSafeURL: allowing same-domain request to {$host}:{$urlPort} (matches webSiteRootURL)");
        return true;
    }
}

This ensures the shortcircuit only fires for requests to the exact same origin (scheme-implied port or explicit port) as the configured site URL.

Severity
7.7 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "wwbn/avideo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "29.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-41060"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-14T23:22:01Z",
    "nvd_published_at": "2026-04-21T23:16:21Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nThe `isSSRFSafeURL()` function in `objects/functions.php` contains a same-domain shortcircuit (lines 4290-4296) that allows any URL whose hostname matches `webSiteRootURL` to bypass all SSRF protections. Because the check compares only the hostname and ignores the port, an attacker can reach arbitrary ports on the AVideo server by using the site\u0027s public hostname with a non-standard port. The response body is saved to a web-accessible path, enabling full exfiltration.\n\n## Details\n\nCommit `40872e529` fixed an extension-based SSRF bypass by making `isSSRFSafeURL()` unconditional. However, `isSSRFSafeURL()` itself contains a same-domain shortcircuit that returns `true` when the URL\u0027s hostname matches `webSiteRootURL`\u0027s hostname, without validating the port:\n\n```php\n// objects/functions.php:4290-4296\nif (!empty($global[\u0027webSiteRootURL\u0027])) {\n    $siteHost = strtolower(parse_url($global[\u0027webSiteRootURL\u0027], PHP_URL_HOST));\n    if ($host === $siteHost) {\n        _error_log(\"isSSRFSafeURL: allowing same-domain request to {$host} (matches webSiteRootURL)\");\n        return true;  // Returns immediately \u2014 port, path, scheme all unchecked\n    }\n}\n```\n\nThe attack flow through `objects/aVideoEncoder.json.php`:\n\n1. User-supplied `$_REQUEST[\u0027downloadURL\u0027]` is passed to `downloadVideoFromDownloadURL()` at line 166\n2. `isSSRFSafeURL()` is called at line 368 \u2014 passes due to hostname match\n3. `url_get_contents($downloadURL)` fetches the attacker-controlled URL at line 378\n4. Response is written to `Video::getStoragePath() . \"cache/tmpFile/\" . basename($downloadURL)` at line 393-395\n\nThe `cache/tmpFile/` directory is under the web-accessible videos storage path. The attacker can retrieve the file to exfiltrate the internal service response.\n\nThe auth requirement is `User::canUpload()` (line 59), which is satisfied by any authenticated user with upload permission. Alternatively, a valid `video_id_hash` (a per-video token) can be used via `useVideoHashOrLogin()` at line 57.\n\n## PoC\n\nAssuming the AVideo instance is at `https://avideo.example.com/` and an internal service runs on port 9998:\n\n```bash\n# Step 1: Authenticate and get cookies (any user with upload permission)\ncurl -c cookies.txt -X POST \u0027https://avideo.example.com/objects/login.json.php\u0027 \\\n  -d \u0027user=testuser\u0026pass=testpass\u0027\n\n# Step 2: Send SSRF request targeting port 9998 on the same host\n# The hostname matches webSiteRootURL so isSSRFSafeURL() returns true\ncurl -b cookies.txt -X POST \u0027https://avideo.example.com/objects/aVideoEncoder.json.php\u0027 \\\n  -d \u0027format=mp4\u0026downloadURL=http://avideo.example.com:9998/large-internal-endpoint.mp4\u0026videos_id=1\u0026first_request=1\u0027\n\n# Step 3: Retrieve the exfiltrated response\n# The file is saved to cache/tmpFile/ with the basename of the URL\ncurl \u0027https://avideo.example.com/videos/cache/tmpFile/large-internal-endpoint.mp4\u0027 -o response.bin\n```\n\nNote: The internal service response must be \u003e= 20KB (or \u003e= 5KB if the URL ends in `.mp3`) to pass the size check at line 384. For smaller responses, the attacker can target endpoints that return verbose output or append padding parameters.\n\nThe fix at `40872e529` specifically mentions blocking `http://127.0.0.1:9998/probe.mp4`. This bypass reaches the exact same internal service by replacing `127.0.0.1` with the site\u0027s public hostname \u2014 the DNS resolution points to the same server.\n\n## Impact\n\n- **Internal service access**: An authenticated attacker can reach any TCP port on the AVideo server that speaks HTTP, including databases with HTTP interfaces, monitoring endpoints, admin panels, cloud metadata services (if the hostname resolves to a cloud instance), and other co-hosted services.\n- **Data exfiltration**: Response bodies are written to a web-accessible directory, allowing the attacker to retrieve internal service responses.\n- **Scope change**: The vulnerability crosses from the AVideo application into other services on the same host, justifying S:C in CVSS scoring.\n- **Bypass of existing fix**: This directly circumvents the SSRF protection added in commit `40872e529`.\n\n## Recommended Fix\n\nThe same-domain shortcircuit should validate that both the hostname and port match `webSiteRootURL`. Replace `objects/functions.php` lines 4290-4296:\n\n```php\n// Allow same-domain requests ONLY if hostname AND port match webSiteRootURL\nif (!empty($global[\u0027webSiteRootURL\u0027])) {\n    $siteHost = strtolower(parse_url($global[\u0027webSiteRootURL\u0027], PHP_URL_HOST));\n    $sitePort = parse_url($global[\u0027webSiteRootURL\u0027], PHP_URL_PORT);\n    $siteScheme = strtolower(parse_url($global[\u0027webSiteRootURL\u0027], PHP_URL_SCHEME));\n    // Default port based on scheme if not explicitly set\n    if (empty($sitePort)) {\n        $sitePort = ($siteScheme === \u0027https\u0027) ? 443 : 80;\n    }\n\n    $urlPort = parse_url($url, PHP_URL_PORT);\n    $urlScheme = strtolower(parse_url($url, PHP_URL_SCHEME));\n    if (empty($urlPort)) {\n        $urlPort = ($urlScheme === \u0027https\u0027) ? 443 : 80;\n    }\n\n    if ($host === $siteHost \u0026\u0026 $urlPort === $sitePort) {\n        _error_log(\"isSSRFSafeURL: allowing same-domain request to {$host}:{$urlPort} (matches webSiteRootURL)\");\n        return true;\n    }\n}\n```\n\nThis ensures the shortcircuit only fires for requests to the exact same origin (scheme-implied port or explicit port) as the configured site URL.",
  "id": "GHSA-j432-4w3j-3w8j",
  "modified": "2026-04-24T20:41:01Z",
  "published": "2026-04-14T23:22:01Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-j432-4w3j-3w8j"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41060"
    },
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/commit/a0156a6398362086390d949190f9d52a823000ba"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/WWBN/AVideo"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "WWBN AVideo has a SSRF via same-domain hostname with alternate port bypasses isSSRFSafeURL"
}

GHSA-J46X-WJ3P-R6QG

Vulnerability from github – Published: 2023-07-11 03:30 – Updated: 2024-04-04 05:54
VLAI
Details

SAP Solution Manager (Diagnostics agent) - version 7.20, allows an unauthenticated attacker to blindly execute HTTP requests. On successful exploitation, the attacker can cause a limited impact on confidentiality and availability of the application and other applications the Diagnostics Agent can reach.

Severity
7.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-36925"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-117",
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-07-11T03:15:10Z",
    "severity": "HIGH"
  },
  "details": "SAP Solution Manager (Diagnostics agent) - version 7.20, allows an unauthenticated attacker to blindly execute HTTP requests. On successful exploitation, the attacker can cause a limited impact on confidentiality and availability of the application and other applications the Diagnostics Agent can reach.\n\n",
  "id": "GHSA-j46x-wj3p-r6qg",
  "modified": "2024-04-04T05:54:47Z",
  "published": "2023-07-11T03:30:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-36925"
    },
    {
      "type": "WEB",
      "url": "https://me.sap.com/notes/3352058"
    },
    {
      "type": "WEB",
      "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-J48Q-H4RM-WPHJ

Vulnerability from github – Published: 2025-06-27 09:31 – Updated: 2025-06-27 09:31
VLAI
Details

The Ninja Tables – Easy Data Table Builder plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.0.18 via the args[url] parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

Severity
7.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-2940"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-06-27T09:15:25Z",
    "severity": "HIGH"
  },
  "details": "The Ninja Tables \u2013 Easy Data Table Builder plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.0.18 via the args[url] parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.",
  "id": "GHSA-j48q-h4rm-wphj",
  "modified": "2025-06-27T09:31:19Z",
  "published": "2025-06-27T09:31:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2940"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/ninja-tables/tags/5.0.18/vendor/wpfluent/framework/src/WPFluent/Http/Client.php#L268"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/ninja-tables/tags/5.0.19/vendor/wpfluent/framework/src/WPFluent/Http/Client.php"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/ninja-tables/trunk/vendor/wpfluent/framework/src/WPFluent/Http/Client.php#L268"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3269692%40ninja-tables\u0026new=3269692%40ninja-tables\u0026sfp_email=\u0026sfph_mail="
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/02480559-be5c-4d23-9e62-bb76fafb4f42?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-J4C5-89F5-F3PM

Vulnerability from github – Published: 2026-04-25 23:49 – Updated: 2026-04-25 23:49
VLAI
Summary
OpenClaw: Browser CDP profile creation skipped strict-mode SSRF checks
Details

Affected Packages / Versions

  • Package: openclaw (npm)
  • Affected versions: < 2026.4.20
  • Patched version: 2026.4.20

Impact

Browser profile creation normalized cdpUrl values before persisting them, but did not apply the configured browser SSRF policy at creation time. In deployments that explicitly disabled private-network CDP targets, a stored profile could still point at a private-network or metadata endpoint and later be probed by normal profile status flows.

Default trusted-operator browser behavior allows private-network CDP endpoints, so this only affected strict-mode deployments. Severity is low.

Fix

OpenClaw now checks CDP endpoints against the browser SSRF policy during profile creation and reachability operations.

Fix commits:

  • 1fd049e3074cac72f6734a7fe88468c84f5f8bd7
  • e90c89cf8b1459f2aa1f3a665be67392b6c03fdf

Release

Fixed in OpenClaw 2026.4.20.

Severity
2.3 (Low)
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "openclaw"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2026.4.20"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-25T23:49:42Z",
    "nvd_published_at": null,
    "severity": "LOW"
  },
  "details": "## Affected Packages / Versions\n\n- Package: `openclaw` (npm)\n- Affected versions: `\u003c 2026.4.20`\n- Patched version: `2026.4.20`\n\n## Impact\n\nBrowser profile creation normalized `cdpUrl` values before persisting them, but did not apply the configured browser SSRF policy at creation time. In deployments that explicitly disabled private-network CDP targets, a stored profile could still point at a private-network or metadata endpoint and later be probed by normal profile status flows.\n\nDefault trusted-operator browser behavior allows private-network CDP endpoints, so this only affected strict-mode deployments. Severity is low.\n\n## Fix\n\nOpenClaw now checks CDP endpoints against the browser SSRF policy during profile creation and reachability operations.\n\nFix commits:\n\n- `1fd049e3074cac72f6734a7fe88468c84f5f8bd7`\n- `e90c89cf8b1459f2aa1f3a665be67392b6c03fdf`\n\n## Release\n\nFixed in OpenClaw `2026.4.20`.",
  "id": "GHSA-j4c5-89f5-f3pm",
  "modified": "2026-04-25T23:49:42Z",
  "published": "2026-04-25T23:49:42Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-j4c5-89f5-f3pm"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/commit/1fd049e3074cac72f6734a7fe88468c84f5f8bd7"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/commit/e90c89cf8b1459f2aa1f3a665be67392b6c03fdf"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/openclaw/openclaw"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "OpenClaw: Browser CDP profile creation skipped strict-mode SSRF checks"
}

GHSA-J4FV-R5W9-H675

Vulnerability from github – Published: 2024-06-26 06:30 – Updated: 2024-08-08 18:31
VLAI
Details

Apache XML Security for C++ through 2.0.4 implements the XML Signature Syntax and Processing (XMLDsig) specification without protection against an SSRF payload in a KeyInfo element. NOTE: the supplier disputes this CVE Record on the grounds that they are implementing the specification "correctly" and are not "at fault."

Severity
5.3 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-34580"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-06-26T05:15:51Z",
    "severity": "MODERATE"
  },
  "details": "Apache XML Security for C++ through 2.0.4 implements the XML Signature Syntax and Processing (XMLDsig) specification without protection against an SSRF payload in a KeyInfo element. NOTE: the supplier disputes this CVE Record on the grounds that they are implementing the specification \"correctly\" and are not \"at fault.\"",
  "id": "GHSA-j4fv-r5w9-h675",
  "modified": "2024-08-08T18:31:19Z",
  "published": "2024-06-26T06:30:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34580"
    },
    {
      "type": "WEB",
      "url": "https://cloud.google.com/blog/topics/threat-intelligence/apache-library-allows-server-side-request-forgery"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zmanion/Vulnerabilities/blob/main/CVE-2024-21893.md"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/po2gocnw4gtf4boy5mmjb54g62qhbrl9"
    },
    {
      "type": "WEB",
      "url": "https://santuario.apache.org/download.html"
    },
    {
      "type": "WEB",
      "url": "https://shibboleth.atlassian.net/wiki/spaces/DEV/pages/3726671873/Santuario"
    },
    {
      "type": "WEB",
      "url": "https://www.sonatype.com/blog/the-exploited-ivanti-connect-ssrf-vulnerability-stems-from-xmltooling-oss-library"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-J4H2-3WWR-928R

Vulnerability from github – Published: 2026-07-14 00:31 – Updated: 2026-07-14 00:31
VLAI
Details

Spring Boot Admin Server before 4.1.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to register instances with attacker-controlled healthUrl and managementUrl parameters without validation against private IP ranges or metadata endpoints. Attackers can force the server to make HTTP requests to arbitrary internal addresses and retrieve response bodies via the actuator proxy to exfiltrate cloud credentials.

Severity
8.6 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
7.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-62242"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-13T22:16:52Z",
    "severity": "HIGH"
  },
  "details": "Spring Boot Admin Server before 4.1.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to register instances with attacker-controlled healthUrl and managementUrl parameters without validation against private IP ranges or metadata endpoints. Attackers can force the server to make HTTP requests to arbitrary internal addresses and retrieve response bodies via the actuator proxy to exfiltrate cloud credentials.",
  "id": "GHSA-j4h2-3wwr-928r",
  "modified": "2026-07-14T00:31:04Z",
  "published": "2026-07-14T00:31:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62242"
    },
    {
      "type": "WEB",
      "url": "https://github.com/codecentric/spring-boot-admin/issues/5452"
    },
    {
      "type": "WEB",
      "url": "https://github.com/codecentric/spring-boot-admin/pull/5464"
    },
    {
      "type": "WEB",
      "url": "https://github.com/codecentric/spring-boot-admin/commit/1f991ea013e46360b8f8fb63fe4ad20a9bf0d551"
    },
    {
      "type": "WEB",
      "url": "https://github.com/codecentric/spring-boot-admin/releases/tag/4.1.2"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/spring-boot-admin-server-ssrf-via-unauthenticated-instance-registration"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

No mitigation information available for this CWE.

CAPEC-664: Server Side Request Forgery

An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.

← Back to the CWE list