CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
4748 vulnerabilities reference this CWE, most recent first.
GHSA-8XPW-Q9JP-X2C7
Vulnerability from github – Published: 2022-07-15 00:00 – Updated: 2022-07-22 00:00Best Practical RT for Incident Response (RTIR) before 4.0.3 and 5.x before 5.0.3 allows SSRF via the whois lookup tool.
{
"affected": [],
"aliases": [
"CVE-2022-25800"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-07-14T12:15:00Z",
"severity": "CRITICAL"
},
"details": "Best Practical RT for Incident Response (RTIR) before 4.0.3 and 5.x before 5.0.3 allows SSRF via the whois lookup tool.",
"id": "GHSA-8xpw-q9jp-x2c7",
"modified": "2022-07-22T00:00:33Z",
"published": "2022-07-15T00:00:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25800"
},
{
"type": "WEB",
"url": "https://docs.bestpractical.com/release-notes/rtir/4.0.3"
},
{
"type": "WEB",
"url": "https://docs.bestpractical.com/release-notes/rtir/5.0.3"
},
{
"type": "WEB",
"url": "https://docs.bestpractical.com/release-notes/rtir/index.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8XQ3-W9FX-74RV
Vulnerability from github – Published: 2025-07-28 16:41 – Updated: 2025-08-01 18:36Description
The lookup function takes a user address for checking accounts as a feature, however, as per the ActivityPub spec (https://www.w3.org/TR/activitypub/#security-considerations), on the security considerations section at B.3, access to Localhost services should be prevented while running in production. The library does not prevent Localhost access (neither does it prevent LAN addresses such as 192.168.x.x) , thus is not safe for use in production by ActivityPub applications. The only check for localhost is done for selecting between HTTP and HTTPS protocols, and it is done by testing for a host that starts with the string “localhost” and ends with a port. Anything else (such as “127.0.0.1” or “localhost:1234/abc”) would not be considered localhost for this test.
In addition, the way that the function determines the host, makes it possible to access any path in the host, not only “/.well-known/...” paths:
if (address.indexOf('://') > -1) {
// other uri format
host = address.replace(/ /g,'').split('/')[2];
} else {
// useraddress
host = address.replace(/ /g,'').split('@')[1];
}
var uri_index = 0; // track which URIS we've tried already
var protocol = 'https'; // we use https by default
if (self.__isLocalhost(host)) {
protocol = 'http';
}
function __buildURL() {
var uri = '';
if (! address.split('://')[1]) {
// the URI has not been defined, default to acct
uri = 'acct:';
}
return protocol + '://' + host + '/.well-known/' +URIS[uri_index] + '?resource=' + uri + address;
}
If the address is in the format of a user address (user@host.com), the host will be anything after the first found @ symbol. Since no other test is done, an adversary may pass a specially crafted address such as user@localhost:7000/admin/restricted_page? and reach pages that would normally be out of reach. In this example, the code would treat localhost:7000/admin/restricted_page? as the host, and the created URL would be https://localhost:7000/admin/restricted_page?/.well-known/webfinger?resource=acct:use r@localhost:7000/admin/restricted_page?. A server listening on localhost:7000 will then parse the request as a GET request for the page /admin/restricted_page with the query string /.well-known/webfinger?resource=acct:user@localhost:7000/admin/restricted_page?.
PoC and Steps to reproduce
This PoC assumes that there is a server on the machine listening on port 3000, which receives requests for WebFinger lookups on the address /api/v1/search_user, and then calls the lookup function in webfinger.js with the user passed as an argument. For the sake of the example we assume that the server configured webfinger.js with tls_only=false.
- Activate a local HTTP server listening to port 1234 with a “secret.txt” file:
python3 -m http.server 1234
- Run the following command:
curl
"http://localhost:3000/api/v1/search_user?search=user@localhost:1234/secret.txt
?"
- View the console of the Python’s HTTP server and see that a request for a “secret.txt?/.well-known/webfinger?resource=acct:user@localhost:1234/secret.txt ?” file was performed. This proves that we can redirect the URL to any domain and path we choose, including localhost and the internal LAN.
Impact
Due to this issue, any user can cause a server using the library to send GET requests with controlled host, path and port in an attempt to query services running on the instance’s host or local network, and attempt to execute a Blind-SSRF gadget in hope of targeting a known vulnerable local service running on the victim’s machine.
References
The vulnerability was discovered by Ori Hollander of the JFrog Vulnerability Research team.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.8.0"
},
"package": {
"ecosystem": "npm",
"name": "webfinger.js"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.8.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-54590"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2025-07-28T16:41:06Z",
"nvd_published_at": "2025-08-01T18:15:55Z",
"severity": "MODERATE"
},
"details": "### Description\nThe lookup function takes a user address for checking accounts as a feature, however, as per\nthe ActivityPub spec (https://www.w3.org/TR/activitypub/#security-considerations), on the\nsecurity considerations section at B.3, access to Localhost services should be prevented while\nrunning in production. The library does not prevent Localhost access (neither does it prevent\nLAN addresses such as 192.168.x.x) , thus is not safe for use in production by ActivityPub\napplications. The only check for localhost is done for selecting between HTTP and HTTPS\nprotocols, and it is done by testing for a host that starts with the string \u201clocalhost\u201d and ends with\na port. Anything else (such as \u201c127.0.0.1\u201d or \u201clocalhost:1234/abc\u201d) would not be considered\nlocalhost for this test.\n\nIn addition, the way that the function determines the host, makes it possible to access any path\nin the host, not only \u201c/.well-known/...\u201d paths:\n\n```javascript\nif (address.indexOf(\u0027://\u0027) \u003e -1) {\n // other uri format\n host = address.replace(/ /g,\u0027\u0027).split(\u0027/\u0027)[2];\n} else {\n // useraddress\n host = address.replace(/ /g,\u0027\u0027).split(\u0027@\u0027)[1];\n}\n\nvar uri_index = 0; // track which URIS we\u0027ve tried already\nvar protocol = \u0027https\u0027; // we use https by default\n\nif (self.__isLocalhost(host)) {\n protocol = \u0027http\u0027;\n}\n\nfunction __buildURL() {\n var uri = \u0027\u0027;\n if (! address.split(\u0027://\u0027)[1]) {\n // the URI has not been defined, default to acct\n uri = \u0027acct:\u0027;\n }\n return protocol + \u0027://\u0027 + host + \u0027/.well-known/\u0027 +URIS[uri_index] + \u0027?resource=\u0027 + uri + address;\n}\n```\n\nIf the address is in the format of a user address (user@host.com), the host will be anything\nafter the first found @ symbol. Since no other test is done, an adversary may pass a specially\ncrafted address such as user@localhost:7000/admin/restricted_page? and reach pages that\nwould normally be out of reach. In this example, the code would treat\nlocalhost:7000/admin/restricted_page? as the host, and the created URL would be\nhttps://localhost:7000/admin/restricted_page?/.well-known/webfinger?resource=acct:use\nr@localhost:7000/admin/restricted_page?. A server listening on localhost:7000 will then\nparse the request as a GET request for the page /admin/restricted_page with the query string\n/.well-known/webfinger?resource=acct:user@localhost:7000/admin/restricted_page?.\n\n### PoC and Steps to reproduce\nThis PoC assumes that there is a server on the machine listening on port 3000, which receives\nrequests for WebFinger lookups on the address /api/v1/search_user, and then calls the lookup\nfunction in webfinger.js with the user passed as an argument. For the sake of the example we\nassume that the server configured webfinger.js with tls_only=false.\n\n\n1. Activate a local HTTP server listening to port 1234 with a \u201csecret.txt\u201d file:\n\n```\npython3 -m http.server 1234\n```\n\n2. Run the following command:\n\n```\ncurl\n\"http://localhost:3000/api/v1/search_user?search=user@localhost:1234/secret.txt\n?\"\n```\n\n3. View the console of the Python\u2019s HTTP server and see that a request for a\n\u201csecret.txt?/.well-known/webfinger?resource=acct:user@localhost:1234/secret.txt\n?\u201d file was performed.\nThis proves that we can redirect the URL to any domain and path we choose, including\nlocalhost and the internal LAN.\n\n\n### Impact\nDue to this issue, any user can cause a server using the library to send GET requests with\ncontrolled host, path and port in an attempt to query services running on the instance\u2019s host or\nlocal network, and attempt to execute a Blind-SSRF gadget in hope of targeting a known\nvulnerable local service running on the victim\u2019s machine.\n\n\n### References\nThe vulnerability was discovered by Ori Hollander of the JFrog Vulnerability Research team.",
"id": "GHSA-8xq3-w9fx-74rv",
"modified": "2025-08-01T18:36:22Z",
"published": "2025-07-28T16:41:06Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/silverbucket/webfinger.js/security/advisories/GHSA-8xq3-w9fx-74rv"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54590"
},
{
"type": "WEB",
"url": "https://github.com/silverbucket/webfinger.js/commit/b5f2f2c957297d25f4d76072963fccaee2e3095a"
},
{
"type": "PACKAGE",
"url": "https://github.com/silverbucket/webfinger.js"
},
{
"type": "WEB",
"url": "https://github.com/silverbucket/webfinger.js/releases/tag/v2.8.1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "webfinger.js Blind SSRF Vulnerability"
}
GHSA-8XQM-6FJ2-HFGF
Vulnerability from github – Published: 2025-12-11 15:30 – Updated: 2025-12-11 17:01A vulnerability was identified in PowerJob up to 5.1.2. This vulnerability affects the function checkConnectivity of the file src/main/java/tech/powerjob/common/utils/net/PingPongUtils.java of the component Network Request Handler. The manipulation of the argument targetIp/targetPort leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "tech.powerjob:powerjob-common"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "5.1.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-14518"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2025-12-11T17:01:45Z",
"nvd_published_at": "2025-12-11T15:15:47Z",
"severity": "MODERATE"
},
"details": "A vulnerability was identified in PowerJob up to 5.1.2. This vulnerability affects the function checkConnectivity of the file src/main/java/tech/powerjob/common/utils/net/PingPongUtils.java of the component Network Request Handler. The manipulation of the argument targetIp/targetPort leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.",
"id": "GHSA-8xqm-6fj2-hfgf",
"modified": "2025-12-11T17:01:45Z",
"published": "2025-12-11T15:30:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14518"
},
{
"type": "WEB",
"url": "https://github.com/PowerJob/PowerJob/issues/1144"
},
{
"type": "WEB",
"url": "https://github.com/PowerJob/PowerJob/issues/1144#issue-3673393002"
},
{
"type": "PACKAGE",
"url": "https://github.com/PowerJob/PowerJob"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.335856"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.335856"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.702896"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": " PowerJob has a server-side request forgery vulnerability in PingPongUtils.java"
}
GHSA-8XWC-6H6P-HH69
Vulnerability from github – Published: 2023-04-16 00:30 – Updated: 2024-04-04 03:29An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is Server-Side Request Forgery (SSRF) via a loopback address to the validate_localhost function in url_blocker.rb.
{
"affected": [],
"aliases": [
"CVE-2018-17452"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-04-15T23:15:00Z",
"severity": "CRITICAL"
},
"details": "An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is Server-Side Request Forgery (SSRF) via a loopback address to the validate_localhost function in url_blocker.rb.",
"id": "GHSA-8xwc-6h6p-hh69",
"modified": "2024-04-04T03:29:31Z",
"published": "2023-04-16T00:30:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-17452"
},
{
"type": "WEB",
"url": "https://about.gitlab.com/blog/categories/releases"
},
{
"type": "WEB",
"url": "https://about.gitlab.com/releases/2018/10/01/security-release-gitlab-11-dot-3-dot-1-released"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9282-M2C9-Q28W
Vulnerability from github – Published: 2025-03-11 15:30 – Updated: 2025-03-11 15:30A vulnerability, which was classified as problematic, was found in Stoque Zeev.it 4.24. This affects an unknown part of the file /Login?inpLostSession=1 of the component Login Page. The manipulation of the argument inpRedirectURL leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2025-2192"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-11T13:15:43Z",
"severity": "MODERATE"
},
"details": "A vulnerability, which was classified as problematic, was found in Stoque Zeev.it 4.24. This affects an unknown part of the file /Login?inpLostSession=1 of the component Login Page. The manipulation of the argument inpRedirectURL leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-9282-m2c9-q28w",
"modified": "2025-03-11T15:30:59Z",
"published": "2025-03-11T15:30:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2192"
},
{
"type": "WEB",
"url": "https://drive.google.com/file/d/17QAEbzVIjTUj8FDOVMwfl9-7j8LRcK4V/view?usp=sharing"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.299217"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.299217"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.511708"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-92J6-RM53-2G46
Vulnerability from github – Published: 2022-05-24 17:34 – Updated: 2023-11-16 15:30Server-side request forgery vulnerability in the ePO extension in McAfee MVISION Endpoint prior to 20.11 allows remote attackers trigger server-side DNS requests to arbitrary domains via carefully constructed XML files loaded by an ePO administrator.
{
"affected": [],
"aliases": [
"CVE-2020-7329"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-11-11T10:15:00Z",
"severity": "HIGH"
},
"details": "Server-side request forgery vulnerability in the ePO extension in McAfee MVISION Endpoint prior to 20.11 allows remote attackers trigger server-side DNS requests to arbitrary domains via carefully constructed XML files loaded by an ePO administrator.",
"id": "GHSA-92j6-rm53-2g46",
"modified": "2023-11-16T15:30:19Z",
"published": "2022-05-24T17:34:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7329"
},
{
"type": "WEB",
"url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10334"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-92VR-3R9M-G89P
Vulnerability from github – Published: 2022-05-24 17:49 – Updated: 2022-05-24 17:49An Unauthenticated Server-Side Request Forgery (SSRF) vulnerability exists in Inim Electronics Smartliving SmartLAN/G/SI <=6.x within the GetImage functionality. The application parses user supplied data in the GET parameter 'host' to construct an image request to the service through onvif.cgi. Since no validation is carried out on the parameter, an attacker can specify an external domain and force the application to make an HTTP request to an arbitrary destination host.
{
"affected": [],
"aliases": [
"CVE-2020-22002"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-04-29T15:15:00Z",
"severity": "HIGH"
},
"details": "An Unauthenticated Server-Side Request Forgery (SSRF) vulnerability exists in Inim Electronics Smartliving SmartLAN/G/SI \u003c=6.x within the GetImage functionality. The application parses user supplied data in the GET parameter \u0027host\u0027 to construct an image request to the service through onvif.cgi. Since no validation is carried out on the parameter, an attacker can specify an external domain and force the application to make an HTTP request to an arbitrary destination host.",
"id": "GHSA-92vr-3r9m-g89p",
"modified": "2022-05-24T17:49:10Z",
"published": "2022-05-24T17:49:10Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-22002"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/172839"
},
{
"type": "WEB",
"url": "https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5545.php"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-92X2-G374-GCVX
Vulnerability from github – Published: 2026-07-15 12:32 – Updated: 2026-07-15 12:32PraisonAI before 1.6.78 contains a server-side request forgery vulnerability in the web_crawl tool that validates hostnames at check time but re-resolves them at connection time without IP pinning. Attackers can use DNS rebinding to bypass SSRF protection and retrieve internal HTTP response bodies from private or loopback services.
{
"affected": [],
"aliases": [
"CVE-2026-61430"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-15T12:18:18Z",
"severity": "HIGH"
},
"details": "PraisonAI before 1.6.78 contains a server-side request forgery vulnerability in the web_crawl tool that validates hostnames at check time but re-resolves them at connection time without IP pinning. Attackers can use DNS rebinding to bypass SSRF protection and retrieve internal HTTP response bodies from private or loopback services.",
"id": "GHSA-92x2-g374-gcvx",
"modified": "2026-07-15T12:32:03Z",
"published": "2026-07-15T12:32:03Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-qg25-6gc4-48mg"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61430"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/praisonai-before-dns-rebinding-ssrf-via-web-crawl"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-92X5-9Q2R-X8GQ
Vulnerability from github – Published: 2024-03-01 00:30 – Updated: 2024-03-01 00:30Recipes version 1.5.10 allows arbitrary HTTP requests to be made
through the server. This is possible because the application is
vulnerable to SSRF.
{
"affected": [],
"aliases": [
"CVE-2024-0403"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-01T00:15:51Z",
"severity": "MODERATE"
},
"details": "Recipes version 1.5.10 allows arbitrary HTTP requests to be made\n\nthrough the server. This is possible because the application is\n\nvulnerable to SSRF.\n\n\n\n\n",
"id": "GHSA-92x5-9q2r-x8gq",
"modified": "2024-03-01T00:30:28Z",
"published": "2024-03-01T00:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0403"
},
{
"type": "WEB",
"url": "https://fluidattacks.com/advisories/harris"
},
{
"type": "WEB",
"url": "https://github.com/TandoorRecipes/recipes"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9389-GQ7V-6FH7
Vulnerability from github – Published: 2022-05-24 17:42 – Updated: 2022-05-24 17:42SSRF in the document conversion component of Webware Webdesktop 5.1.15 allows an attacker to read all files from the server.
{
"affected": [],
"aliases": [
"CVE-2021-3204"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-02-19T14:15:00Z",
"severity": "MODERATE"
},
"details": "SSRF in the document conversion component of Webware Webdesktop 5.1.15 allows an attacker to read all files from the server.",
"id": "GHSA-9389-gq7v-6fh7",
"modified": "2022-05-24T17:42:42Z",
"published": "2022-05-24T17:42:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3204"
},
{
"type": "WEB",
"url": "https://www.l0l.xyz/sec/2021/01/05/1-webdesktop-root-ssrf.html"
}
],
"schema_version": "1.4.0",
"severity": []
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.