CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
4755 vulnerabilities reference this CWE, most recent first.
GHSA-943R-XVQQ-R4RH
Vulnerability from github – Published: 2022-05-14 03:42 – Updated: 2025-04-20 03:34PHP through 7.1.11 enables potential SSRF in applications that accept an fsockopen or pfsockopen hostname argument with an expectation that the port number is constrained. Because a :port syntax is recognized, fsockopen will use the port number that is specified in the hostname argument, instead of the port number in the second argument of the function.
{
"affected": [],
"aliases": [
"CVE-2017-7272"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-03-27T17:59:00Z",
"severity": "HIGH"
},
"details": "PHP through 7.1.11 enables potential SSRF in applications that accept an fsockopen or pfsockopen hostname argument with an expectation that the port number is constrained. Because a :port syntax is recognized, fsockopen will use the port number that is specified in the hostname argument, instead of the port number in the second argument of the function.",
"id": "GHSA-943r-xvqq-r4rh",
"modified": "2025-04-20T03:34:51Z",
"published": "2022-05-14T03:42:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7272"
},
{
"type": "WEB",
"url": "https://github.com/php/php-src/commit/bab0b99f376dac9170ac81382a5ed526938d595a"
},
{
"type": "WEB",
"url": "https://bugs.php.net/bug.php?id=74216"
},
{
"type": "WEB",
"url": "https://bugs.php.net/bug.php?id=75505"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20180112-0001"
},
{
"type": "WEB",
"url": "https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20170403-0_PHP_Misbehavior_of_fsockopen_function_v10.txt"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/97178"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1038158"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-94HW-32GV-86PF
Vulnerability from github – Published: 2024-11-04 15:31 – Updated: 2024-11-04 15:31AppSmith Community 1.8.3 before 1.46 allows SSRF via New DataSource for application/json requests to 169.254.169.254 to retrieve AWS metadata credentials.
{
"affected": [],
"aliases": [
"CVE-2024-51408"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-04T14:15:16Z",
"severity": "HIGH"
},
"details": "AppSmith Community 1.8.3 before 1.46 allows SSRF via New DataSource for application/json requests to 169.254.169.254 to retrieve AWS metadata credentials.",
"id": "GHSA-94hw-32gv-86pf",
"modified": "2024-11-04T15:31:58Z",
"published": "2024-11-04T15:31:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51408"
},
{
"type": "WEB",
"url": "https://github.com/appsmithorg/appsmith/pull/29286"
},
{
"type": "WEB",
"url": "https://github.com/appsmithorg/appsmith/releases/tag/v1.46"
},
{
"type": "WEB",
"url": "https://github.com/jahithoque/Vulnerability-Research/tree/main/CVE-2024-51408"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-953P-CW63-FHM7
Vulnerability from github – Published: 2022-12-22 00:30 – Updated: 2022-12-28 21:30Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where a specially crafted PHP script could use parameters from a HTTP request to create a URL capable of changing the host parameter. The changed host parameter in the HTTP could point to another host that will send a request to the host or IP specified in the changed host parameter.
{
"affected": [],
"aliases": [
"CVE-2022-3189"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-12-21T23:15:00Z",
"severity": "MODERATE"
},
"details": "Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where a specially crafted PHP script could use parameters from a HTTP request to create a URL capable of changing the host parameter. The changed host parameter in the HTTP could point to another host that will send a request to the host or IP specified in the changed host parameter.",
"id": "GHSA-953p-cw63-fhm7",
"modified": "2022-12-28T21:30:23Z",
"published": "2022-12-22T00:30:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3189"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-263-03"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9592-7844-9GM7
Vulnerability from github – Published: 2022-05-24 19:03 – Updated: 2022-05-24 19:03IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-ForceID: 194597.
{
"affected": [],
"aliases": [
"CVE-2021-20348"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-06-02T21:15:00Z",
"severity": "MODERATE"
},
"details": "IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-ForceID: 194597.",
"id": "GHSA-9592-7844-9gm7",
"modified": "2022-05-24T19:03:49Z",
"published": "2022-05-24T19:03:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20348"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/194597"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/6457739"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-95C3-6VVW-4MRQ
Vulnerability from github – Published: 2026-05-08 17:06 – Updated: 2026-05-15 23:47[SECURITY] registry_001 Vulnerability Report
While analyzing the code logic, an area that may lead to unintended behavior under specific conditions was discovered.
Overview
- Verified Version:
c5c4b9e8890dd5754bee889b2f1417f4fe3b5ce5 - Vulnerability Type: Authentication bypass via cross-registry OIDC token replay
- Affected Location:
cmd/publisher/commands/login.go:67-105,130-135,199-224;cmd/publisher/auth/github-oidc.go:24-38,58-75,108-165;internal/api/handlers/v0/auth/github_oidc.go:75-135,229-277,280-296 - Trigger Scenario: a workflow invokes
mcp-publisher login github-oidc --registry <other-registry>(or equivalent publish flow) and the publisher still requests a GitHub Actions ID token with the shared audiencemcp-registry; any other registry deployment running this code can replay that token to its own/v0/auth/github-oidcendpoint and mint a publish-capable registry JWT for the same GitHub owner namespace.
Root Cause
The client-side and server-side GitHub OIDC flow is bound only to a global audience string, not to the specific registry instance being targeted. On the client side, the publisher always appends audience=mcp-registry when requesting the GitHub Actions ID token, regardless of the selected --registry URL. On the server side, the exchange endpoint validates only that same fixed audience and then derives publish permissions directly from repository_owner. As a result, a token legitimately obtained while interacting with one registry deployment remains acceptable to any other deployment that shares the same code and audience string.
Source-to-Sink Chain
- Source
cmd/publisher/commands/login.go:67-105,130-135,199-224parses the user-controlled--registryflag intoflags.RegistryURL, creates aGitHubOIDCProvider, and callsauthProvider.GetToken(ctx)for the chosen authentication method. - Propagation
cmd/publisher/auth/github-oidc.go:24-38obtains an OIDC token and immediately exchanges it against the selected registry URL.cmd/publisher/auth/github-oidc.go:58-75buildsexchangeURL := o.registryURL + "/v0/auth/github-oidc"and posts the GitHub token to whichever registry instance was selected.cmd/publisher/auth/github-oidc.go:108-165constructsfullURL := requestURL + "&audience=mcp-registry"and therefore requests the same audience for every registry deployment. - Sink
internal/api/handlers/v0/auth/github_oidc.go:75-135validates only the shared audience value passed intoValidateToken.internal/api/handlers/v0/auth/github_oidc.go:254-277callsh.validator.ValidateToken(ctx, oidcToken, "mcp-registry")and, on success, signs a new registry JWT.internal/api/handlers/v0/auth/github_oidc.go:280-296convertsclaims.RepositoryOwnerinto the publish permission patternio.github.<owner>/*, which is then embedded into the new registry JWT.
Exploitation Preconditions
- The victim uses the GitHub Actions OIDC publishing path.
- The victim workflow targets another registry deployment first, such as staging, self-hosted infrastructure, or an attacker-controlled registry URL.
- The receiving registry deployment can observe the posted OIDC token and replay it before expiry to another registry deployment running the same shared audience configuration.
Risk
This breaks deployment isolation between registry instances. A token issued for one registry interaction can be replayed across trust boundaries, allowing one deployment to impersonate the same GitHub owner identity on another deployment.
Impact
An attacker-controlled or compromised registry deployment can mint a valid registry JWT on another deployment and inherit publish permissions for the victim GitHub owner namespace. In practical terms, this enables unauthorized publication or update actions for names such as io.github.<owner>/* on the victim registry instance.
Remediation
- Replace the shared audience string with a registry-specific audience, such as a deployment-specific client ID or origin-derived identifier.
- Ensure the publisher requests the audience that matches the exact registry instance it is targeting, and ensure the server validates that same instance-specific value.
- Consider binding the exchange to additional deployment-specific claims so that a token captured by one registry cannot be replayed on another.
- Add regression tests that cover cross-deployment replay attempts between different registry URLs.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/modelcontextprotocol/registry"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.7.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-44428"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-08T17:06:22Z",
"nvd_published_at": "2026-05-14T22:16:44Z",
"severity": "LOW"
},
"details": "# [SECURITY] registry_001 Vulnerability Report\n\nWhile analyzing the code logic, an area that may lead to unintended behavior under specific conditions was discovered. \n\n## Overview\n- Verified Version: `c5c4b9e8890dd5754bee889b2f1417f4fe3b5ce5`\n- Vulnerability Type: Authentication bypass via cross-registry OIDC token replay\n- Affected Location: `cmd/publisher/commands/login.go:67-105,130-135,199-224`; `cmd/publisher/auth/github-oidc.go:24-38,58-75,108-165`; `internal/api/handlers/v0/auth/github_oidc.go:75-135,229-277,280-296`\n- Trigger Scenario: a workflow invokes `mcp-publisher login github-oidc --registry \u003cother-registry\u003e` (or equivalent publish flow) and the publisher still requests a GitHub Actions ID token with the shared audience `mcp-registry`; any other registry deployment running this code can replay that token to its own `/v0/auth/github-oidc` endpoint and mint a publish-capable registry JWT for the same GitHub owner namespace.\n\n## Root Cause\nThe client-side and server-side GitHub OIDC flow is bound only to a global audience string, not to the specific registry instance being targeted. On the client side, the publisher always appends `audience=mcp-registry` when requesting the GitHub Actions ID token, regardless of the selected `--registry` URL. On the server side, the exchange endpoint validates only that same fixed audience and then derives publish permissions directly from `repository_owner`. As a result, a token legitimately obtained while interacting with one registry deployment remains acceptable to any other deployment that shares the same code and audience string.\n\n## Source-to-Sink Chain\n1. Source\n `cmd/publisher/commands/login.go:67-105,130-135,199-224` parses the user-controlled `--registry` flag into `flags.RegistryURL`, creates a `GitHubOIDCProvider`, and calls `authProvider.GetToken(ctx)` for the chosen authentication method.\n2. Propagation\n `cmd/publisher/auth/github-oidc.go:24-38` obtains an OIDC token and immediately exchanges it against the selected registry URL.\n `cmd/publisher/auth/github-oidc.go:58-75` builds `exchangeURL := o.registryURL + \"/v0/auth/github-oidc\"` and posts the GitHub token to whichever registry instance was selected.\n `cmd/publisher/auth/github-oidc.go:108-165` constructs `fullURL := requestURL + \"\u0026audience=mcp-registry\"` and therefore requests the same audience for every registry deployment.\n3. Sink\n `internal/api/handlers/v0/auth/github_oidc.go:75-135` validates only the shared audience value passed into `ValidateToken`.\n `internal/api/handlers/v0/auth/github_oidc.go:254-277` calls `h.validator.ValidateToken(ctx, oidcToken, \"mcp-registry\")` and, on success, signs a new registry JWT.\n `internal/api/handlers/v0/auth/github_oidc.go:280-296` converts `claims.RepositoryOwner` into the publish permission pattern `io.github.\u003cowner\u003e/*`, which is then embedded into the new registry JWT.\n\n## Exploitation Preconditions\n1. The victim uses the GitHub Actions OIDC publishing path.\n2. The victim workflow targets another registry deployment first, such as staging, self-hosted infrastructure, or an attacker-controlled registry URL.\n3. The receiving registry deployment can observe the posted OIDC token and replay it before expiry to another registry deployment running the same shared audience configuration.\n\n## Risk\nThis breaks deployment isolation between registry instances. A token issued for one registry interaction can be replayed across trust boundaries, allowing one deployment to impersonate the same GitHub owner identity on another deployment.\n\n## Impact\nAn attacker-controlled or compromised registry deployment can mint a valid registry JWT on another deployment and inherit publish permissions for the victim GitHub owner namespace. In practical terms, this enables unauthorized publication or update actions for names such as `io.github.\u003cowner\u003e/*` on the victim registry instance.\n\n## Remediation\n1. Replace the shared audience string with a registry-specific audience, such as a deployment-specific client ID or origin-derived identifier.\n2. Ensure the publisher requests the audience that matches the exact registry instance it is targeting, and ensure the server validates that same instance-specific value.\n3. Consider binding the exchange to additional deployment-specific claims so that a token captured by one registry cannot be replayed on another.\n4. Add regression tests that cover cross-deployment replay attempts between different registry URLs.",
"id": "GHSA-95c3-6vvw-4mrq",
"modified": "2026-05-15T23:47:13Z",
"published": "2026-05-08T17:06:22Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/modelcontextprotocol/registry/security/advisories/GHSA-95c3-6vvw-4mrq"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44428"
},
{
"type": "WEB",
"url": "https://github.com/modelcontextprotocol/registry/pull/1229"
},
{
"type": "WEB",
"url": "https://github.com/modelcontextprotocol/registry/commit/3f89fc2b1fb34fd49f3c0e1b39e964a5c67b613f"
},
{
"type": "PACKAGE",
"url": "https://github.com/modelcontextprotocol/registry"
},
{
"type": "WEB",
"url": "https://github.com/modelcontextprotocol/registry/releases/tag/v1.7.6"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N",
"type": "CVSS_V4"
}
],
"summary": "MCP Registry\u0027s GitHub OIDC tokens are replayable across registry deployments due to shared audience"
}
GHSA-95CP-92VM-RCPC
Vulnerability from github – Published: 2026-07-14 06:31 – Updated: 2026-07-14 06:31A vulnerability has been found in louisho5 picobot up to 0.2.0. This vulnerability affects the function WebTool.Execute of the file internal/agent/tools/web.go of the component web Tool. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
{
"affected": [],
"aliases": [
"CVE-2026-15668"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-14T05:16:18Z",
"severity": "LOW"
},
"details": "A vulnerability has been found in louisho5 picobot up to 0.2.0. This vulnerability affects the function WebTool.Execute of the file internal/agent/tools/web.go of the component web Tool. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.",
"id": "GHSA-95cp-92vm-rcpc",
"modified": "2026-07-14T06:31:22Z",
"published": "2026-07-14T06:31:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15668"
},
{
"type": "WEB",
"url": "https://github.com/louisho5/picobot/issues/41"
},
{
"type": "WEB",
"url": "https://github.com/louisho5/picobot"
},
{
"type": "WEB",
"url": "https://vuldb.com/cve/CVE-2026-15668"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/855866"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/378162"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/378162/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-95R8-F778-2VMC
Vulnerability from github – Published: 2022-05-24 16:54 – Updated: 2024-04-04 01:44A Server-Side Request Forgery (SSRF) vulnerability in the backup & restore functionality in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9.3.0 allows a remote attacker to forge GET requests to arbitrary URLs. In addition, this could potentially allow an attacker to read sensitive zip files from the local server.
{
"affected": [],
"aliases": [
"CVE-2019-11897"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-08-21T18:15:00Z",
"severity": "HIGH"
},
"details": "A Server-Side Request Forgery (SSRF) vulnerability in the backup \u0026 restore functionality in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9.3.0 allows a remote attacker to forge GET requests to arbitrary URLs. In addition, this could potentially allow an attacker to read sensitive zip files from the local server.",
"id": "GHSA-95r8-f778-2vmc",
"modified": "2024-04-04T01:44:34Z",
"published": "2022-05-24T16:54:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11897"
},
{
"type": "WEB",
"url": "https://psirt.bosch.com/Advisory/BOSCH-SA-562575.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-95WR-3F2V-V2WH
Vulnerability from github – Published: 2026-04-14 23:36 – Updated: 2026-04-24 20:42Summary
The resource-js endpoint in Craft CMS allows unauthenticated requests to proxy remote JavaScript resources.
When trustedHosts is not explicitly restricted (default configuration), the application trusts the client-supplied Host header.
This allows an attacker to control the derived baseUrl, which is used in prefix validation inside actionResourceJs().
By supplying a malicious Host header, the attacker can make the server issue arbitrary HTTP requests, leading to Server-Side Request Forgery (SSRF).
Details
The vulnerability exists in AppController::actionResourceJs().
The function validates that the url parameter starts with assetManager->baseUrl. However, baseUrl is derived from the current request host. If trustedHosts is not configured, the Host header is fully attacker-controlled.
Attack chain:
- Attacker sends request with controlled
Hostheader. - Application derives
baseUrlfrom the malicious Host. urlparameter is required to start with thisbaseUrl.- Validation passes.
- Guzzle performs a server-side HTTP request to the attacker-controlled host.
- SSRF occurs.
This does not rely on string parsing bypass. It relies on Host header trust.
PoC (safe reproduction steps)
Environment: - Craft CMS 5.9.12 - Default configuration (no trustedHosts restriction) - Docker deployment
-
Start a listener inside the container: python3 -m http.server 9999
-
Send a request to resource-js with a controlled Host header.
-
Observe that the internal listener receives a request (OOB confirmation).
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 5.9.14"
},
"package": {
"ecosystem": "Packagist",
"name": "craftcms/cms"
},
"ranges": [
{
"events": [
{
"introduced": "5.0.0-RC1"
},
{
"fixed": "5.9.15"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 4.17.8"
},
"package": {
"ecosystem": "Packagist",
"name": "craftcms/cms"
},
"ranges": [
{
"events": [
{
"introduced": "4.0.0-RC1"
},
{
"fixed": "4.17.9"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-41130"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-14T23:36:09Z",
"nvd_published_at": "2026-04-22T00:16:28Z",
"severity": "MODERATE"
},
"details": "### Summary\n\nThe `resource-js` endpoint in Craft CMS allows unauthenticated requests to proxy remote JavaScript resources. \nWhen `trustedHosts` is not explicitly restricted (default configuration), the application trusts the client-supplied Host header. \n\nThis allows an attacker to control the derived `baseUrl`, which is used in prefix validation inside `actionResourceJs()`. \nBy supplying a malicious Host header, the attacker can make the server issue arbitrary HTTP requests, leading to Server-Side Request Forgery (SSRF).\n\n### Details\n\nThe vulnerability exists in `AppController::actionResourceJs()`.\n\nThe function validates that the `url` parameter starts with `assetManager-\u003ebaseUrl`. However, `baseUrl` is derived from the current request host. If `trustedHosts` is not configured, the Host header is fully attacker-controlled.\n\nAttack chain:\n\n1. Attacker sends request with controlled `Host` header.\n2. Application derives `baseUrl` from the malicious Host.\n3. `url` parameter is required to start with this `baseUrl`.\n4. Validation passes.\n5. Guzzle performs a server-side HTTP request to the attacker-controlled host.\n6. SSRF occurs.\n\nThis does not rely on string parsing bypass. It relies on Host header trust.\n\n### PoC (safe reproduction steps)\n\nEnvironment:\n- Craft CMS 5.9.12\n- Default configuration (no trustedHosts restriction)\n- Docker deployment\n\n1. Start a listener inside the container:\n python3 -m http.server 9999\n\n2. Send a request to resource-js with a controlled Host header.\n\n3. Observe that the internal listener receives a request (OOB confirmation).",
"id": "GHSA-95wr-3f2v-v2wh",
"modified": "2026-04-24T20:42:23Z",
"published": "2026-04-14T23:36:09Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/craftcms/cms/security/advisories/GHSA-95wr-3f2v-v2wh"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41130"
},
{
"type": "WEB",
"url": "https://github.com/craftcms/cms/commit/ebe7e85f1c89700d64332f72492be2e9a594e783"
},
{
"type": "PACKAGE",
"url": "https://github.com/craftcms/cms"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"type": "CVSS_V4"
}
],
"summary": "Craft CMS has a host header injection leading to SSRF via resource-js endpoint"
}
GHSA-95WW-475F-PR4F
Vulnerability from github – Published: 2026-04-20 00:30 – Updated: 2026-04-22 22:02A security flaw has been discovered in vibrantlabsai RAGAS up to 0.4.3. The affected element is the function _try_process_local_file/_try_process_url of the file src/ragas/metrics/collections/multi_modal_faithfulness/util.py of the component Collections Module. Performing a manipulation of the argument retrieved_contexts results in server-side request forgery. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The security patch for CVE-2025-45691 was applied to a different module only. The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "ragas"
},
"ranges": [
{
"events": [
{
"introduced": "0.2.3"
},
{
"last_affected": "0.4.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-6587"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-22T22:02:02Z",
"nvd_published_at": "2026-04-20T00:16:34Z",
"severity": "LOW"
},
"details": "A security flaw has been discovered in vibrantlabsai RAGAS up to 0.4.3. The affected element is the function _try_process_local_file/_try_process_url of the file src/ragas/metrics/collections/multi_modal_faithfulness/util.py of the component Collections Module. Performing a manipulation of the argument retrieved_contexts results in server-side request forgery. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The security patch for CVE-2025-45691 was applied to a different module only. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-95ww-475f-pr4f",
"modified": "2026-04-22T22:02:02Z",
"published": "2026-04-20T00:30:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6587"
},
{
"type": "WEB",
"url": "https://adithyanak.com/ragas-v0214-arbitrary-file-read-vulnerability"
},
{
"type": "PACKAGE",
"url": "https://github.com/vibrantlabsai/ragas"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/791088"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/358222"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/358222/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"type": "CVSS_V4"
}
],
"summary": "RAGAS has SSRF via Multi-Modal Faithfulness Collections Module"
}
GHSA-95X4-2J8Q-MF8Q
Vulnerability from github – Published: 2026-02-17 21:31 – Updated: 2026-02-17 21:31IBM Concert 1.0.0 through 2.1.0 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
{
"affected": [],
"aliases": [
"CVE-2025-36243"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-17T20:22:03Z",
"severity": "MODERATE"
},
"details": "IBM Concert 1.0.0 through 2.1.0 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.",
"id": "GHSA-95x4-2j8q-mf8q",
"modified": "2026-02-17T21:31:14Z",
"published": "2026-02-17T21:31:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-36243"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7260162"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.