CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
4755 vulnerabilities reference this CWE, most recent first.
GHSA-GRXP-XWH4-267V
Vulnerability from github – Published: 2026-04-08 18:34 – Updated: 2026-04-08 18:34Server-Side Request Forgery (CWE-918) in Kibana One Workflow can lead to information disclosure. An authenticated user with workflow creation and execution privileges can bypass host allowlist restrictions in the Workflows Execution Engine, potentially exposing sensitive internal endpoints and data.
{
"affected": [],
"aliases": [
"CVE-2026-33458"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-08T18:26:00Z",
"severity": "MODERATE"
},
"details": "Server-Side Request Forgery (CWE-918) in Kibana One Workflow can lead to information disclosure. An authenticated user with workflow creation and execution privileges can bypass host allowlist restrictions in the Workflows Execution Engine, potentially exposing sensitive internal endpoints and data.",
"id": "GHSA-grxp-xwh4-267v",
"modified": "2026-04-08T18:34:08Z",
"published": "2026-04-08T18:34:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33458"
},
{
"type": "WEB",
"url": "https://discuss.elastic.co/t/kibana-9-3-3-security-update-esa-2026-28/385815"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GV6R-FMG6-C7V4
Vulnerability from github – Published: 2026-04-03 21:31 – Updated: 2026-04-03 21:31prompts.chat prior to commit 1464475 contains a blind server-side request forgery vulnerability in the Wiro media generator that allows authenticated users to perform server-side fetches of user-controlled inputImageUrl parameters. Attackers can exploit this vulnerability by sending POST requests to the /api/media-generate endpoint to probe internal networks, access internal services, and exfiltrate data through the upstream Wiro service without receiving direct response bodies.
{
"affected": [],
"aliases": [
"CVE-2026-22662"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-03T21:17:09Z",
"severity": "MODERATE"
},
"details": "prompts.chat prior to commit 1464475 contains a blind server-side request forgery vulnerability in the Wiro media generator that allows authenticated users to perform server-side fetches of user-controlled inputImageUrl parameters. Attackers can exploit this vulnerability by sending POST requests to the /api/media-generate endpoint to probe internal networks, access internal services, and exfiltrate data through the upstream Wiro service without receiving direct response bodies.",
"id": "GHSA-gv6r-fmg6-c7v4",
"modified": "2026-04-03T21:31:42Z",
"published": "2026-04-03T21:31:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22662"
},
{
"type": "WEB",
"url": "https://github.com/f/prompts.chat/pull/1102"
},
{
"type": "WEB",
"url": "https://github.com/f/prompts.chat/commit/1464475df2698fb7ccd0cdbc382b0750466f891d"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/prompts-chat-blind-ssrf-via-media-generate"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-GV7G-X59X-WF8F
Vulnerability from github – Published: 2023-04-07 19:23 – Updated: 2023-04-14 20:30Summary
The SvelteKit framework offers developers an option to create simple REST APIs. This is done by defining a +server.js file, containing endpoint handlers for different HTTP methods.
SvelteKit provides out-of-the-box cross-site request forgery (CSRF) protection to its users. The protection is implemented at kit/src/runtime/server/respond.js. While the implementation does a sufficient job of mitigating common CSRF attacks, the protection can be bypassed by simply specifying an upper-cased Content-Type header value. The browser will not send uppercase characters on form submission, but this check does not block all expected cross-site requests: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simple_requests
Details
The CSRF protection is implemented using the code shown below.
const forbidden =
is_form_content_type(request) &&
(request.method === 'POST' ||
request.method === 'PUT' ||
request.method === 'PATCH' ||
request.method === 'DELETE') &&
request.headers.get('origin') !== url.origin;
if (forbidden) {
const csrf_error = error(403, `Cross-site ${request.method} form submissions are forbidden`);
if (request.headers.get('accept') === 'application/json') {
return json(csrf_error.body, { status: csrf_error.status });
}
return text(csrf_error.body.message, { status: csrf_error.status });
}
If the incoming request specifies a POST/PUT/PATCH/DELETE method, the protection will compare the server’s origin with the value of the HTTP Origin header. A mismatch between these values signals that a potential attack has been detected. The final check is performed on the request’s Content-Type header whether the value is either application/x-www-form-urlencoded, multipart/form-data or text/plain. If all the previous checks pass, the request will be rejected with an 403 error response.
However, is_form_content_type, which is responsible for checking the value of the Content-Type header, is not sufficient to mitigate all possible variations of this type of attack. Since this function is checking Content-Type with lower-cased values, and the browser accepts upper-cased Content-Type header to be sent, a CSRF attack performed with the Content-Type header that contains an upper-cased character (e.g., text/plaiN) can circumvent the protection and the request will be processed by the endpoint handler.
Impact
If abused, this issue will allow malicious requests to be submitted from third-party domains, which can allow execution of operations within the context of the victim's session, and in extreme scenarios can lead to unauthorized access to users’ accounts. This may lead to all POST operations requiring authentication being allowed in the following cases:
1. If the target site sets SameSite=None on its auth cookie and the user visits a malicious site in a Chromium-based browser
2. If the target site doesn't set the SameSite attribute explicitly and the user visits a malicious site with Firefox/Safari with tracking protections turned off.
3. If the user is visiting a malicious site with a very outdated browser.
Remediations
It is preferred to update to SvelteKit 1.15.2. It is also recommended to explicitly set SameSite to a value other than None on authentication cookies especially if the upgrade cannot be done in a timely manner.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@sveltejs/kit"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.15.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-29008"
],
"database_specific": {
"cwe_ids": [
"CWE-352",
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2023-04-07T19:23:31Z",
"nvd_published_at": "2023-04-06T17:15:00Z",
"severity": "HIGH"
},
"details": "### Summary\nThe SvelteKit framework offers developers an option to create simple REST APIs. This is done by defining a `+server.js` file, containing endpoint handlers for different HTTP methods.\n\nSvelteKit provides out-of-the-box cross-site request forgery (CSRF) protection to its users. The protection is implemented at `kit/src/runtime/server/respond.js`. While the implementation does a sufficient job of mitigating common CSRF attacks, the protection can be bypassed by simply specifying an upper-cased `Content-Type` header value. The browser will not send uppercase characters on form submission, but this check does not block all expected cross-site requests: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simple_requests\n\n### Details\nThe CSRF protection is implemented using the code shown below.\n\n``` javascript\n\t\tconst forbidden =\n\t\t\tis_form_content_type(request) \u0026\u0026\n\t\t\t(request.method === \u0027POST\u0027 ||\n\t\t\t\trequest.method === \u0027PUT\u0027 ||\n\t\t\t\trequest.method === \u0027PATCH\u0027 ||\n\t\t\t\trequest.method === \u0027DELETE\u0027) \u0026\u0026\n\t\t\trequest.headers.get(\u0027origin\u0027) !== url.origin;\n\n\t\tif (forbidden) {\n\t\t\tconst csrf_error = error(403, `Cross-site ${request.method} form submissions are forbidden`);\n\t\t\tif (request.headers.get(\u0027accept\u0027) === \u0027application/json\u0027) {\n\t\t\t\treturn json(csrf_error.body, { status: csrf_error.status });\n\t\t\t}\n\t\t\treturn text(csrf_error.body.message, { status: csrf_error.status });\n\t\t}\n```\n\nIf the incoming request specifies a POST/PUT/PATCH/DELETE method, the protection will compare the server\u2019s origin with the value of the HTTP Origin header. A mismatch between these values signals that a potential attack has been detected. The final check is performed on the request\u2019s `Content-Type` header whether the value is either `application/x-www-form-urlencoded`, `multipart/form-data` or `text/plain`. If all the previous checks pass, the request will be rejected with an 403 error response.\nHowever, `is_form_content_type`, which is responsible for checking the value of the `Content-Type` header, is not sufficient to mitigate all possible variations of this type of attack. Since this function is checking `Content-Type` with lower-cased values, and the browser accepts upper-cased `Content-Type` header to be sent, a CSRF attack performed with the `Content-Type` header that contains an upper-cased character (e.g., `text/plaiN`) can circumvent the protection and the request will be processed by the endpoint handler.\n\u003c!--\n### PoC\n1. Set up the SvelteKit with `POST /api/test` endpoint.\n2. Replace `REPLACE_DOMAIN` in the following HTML.\n``` html\n\u003cscript\u003e\n(async() =\u003e {\n\tawait fetch(\"https://REPLACE_DOMAIN/api/test\", {method: \"POST\", headers:{\"Content-Type\":\"text/plaiN\"}, body: \"hello=world\"});\n})();\n\u003c/script\u003e\n```\n3. Confirm that a POST request is processed by the server.\n--\u003e\n### Impact\nIf abused, this issue will allow malicious requests to be submitted from third-party domains, which can allow execution of operations within the context of the victim\u0027s session, and in extreme scenarios can lead to unauthorized access to users\u2019 accounts. This may lead to all POST operations requiring authentication being allowed in the following cases:\n1. If the target site sets `SameSite=None` on its auth cookie and the user visits a malicious site in a Chromium-based browser\n2. If the target site doesn\u0027t set the `SameSite` attribute explicitly and the user visits a malicious site with Firefox/Safari with tracking protections turned off.\n3. If the user is visiting a malicious site with a very outdated browser.\n\n### Remediations\nIt is preferred to update to SvelteKit 1.15.2. It is also recommended to explicitly set `SameSite` to a value other than `None` on authentication cookies especially if the upgrade cannot be done in a timely manner.",
"id": "GHSA-gv7g-x59x-wf8f",
"modified": "2023-04-14T20:30:47Z",
"published": "2023-04-07T19:23:31Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/sveltejs/kit/security/advisories/GHSA-gv7g-x59x-wf8f"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-29008"
},
{
"type": "WEB",
"url": "https://github.com/sveltejs/kit/commit/ba436c6685e751d968a960fbda65f24cf7a82e9f"
},
{
"type": "PACKAGE",
"url": "https://github.com/sveltejs/kit"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "SvelteKit framework has Insufficient CSRF protection for CORS requests"
}
GHSA-GV7X-PQ3J-C5MJ
Vulnerability from github – Published: 2026-06-01 21:30 – Updated: 2026-06-01 21:30Nanobot prior to version 0.2.1 contains a server-side request forgery vulnerability in the Microsoft Teams channel handler that allows remote attackers to exfiltrate Bot Framework bearer tokens by supplying a forged activity with an attacker-controlled serviceUrl value. Attackers can poison the stored conversation reference by sending a crafted inbound activity to the Teams webhook, causing subsequent bot replies to transmit token-bearing Authorization header requests to an attacker-controlled host.
{
"affected": [],
"aliases": [
"CVE-2026-49139"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-01T21:16:46Z",
"severity": "HIGH"
},
"details": "Nanobot prior to version 0.2.1 contains a server-side request forgery vulnerability in the Microsoft Teams channel handler that allows remote attackers to exfiltrate Bot Framework bearer tokens by supplying a forged activity with an attacker-controlled serviceUrl value. Attackers can poison the stored conversation reference by sending a crafted inbound activity to the Teams webhook, causing subsequent bot replies to transmit token-bearing Authorization header requests to an attacker-controlled host.",
"id": "GHSA-gv7x-pq3j-c5mj",
"modified": "2026-06-01T21:30:45Z",
"published": "2026-06-01T21:30:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49139"
},
{
"type": "WEB",
"url": "https://github.com/HKUDS/nanobot/pull/4047"
},
{
"type": "WEB",
"url": "https://github.com/HKUDS/nanobot/commit/232df45126bcf0f8fccd123d73714f202c8e8612"
},
{
"type": "WEB",
"url": "https://github.com/HKUDS/nanobot/releases/tag/v0.2.1"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/nanobot-ssrf-via-microsoft-teams-channel-serviceurl-poisoning"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-GV8R-56HQ-95M6
Vulnerability from github – Published: 2025-04-04 12:30 – Updated: 2025-08-22 00:30A server-side request forgery (SSRF) vulnerability exists in the Bitdefender GravityZone Update Server when operating in Relay Mode. The HTTP proxy component on port 7074 uses a domain allowlist to restrict outbound requests, but fails to properly sanitize hostnames containing null-byte (%00) sequences. By crafting a request to a domain such as evil.com%00.bitdefender.com, an attacker can bypass the allowlist check, causing the proxy to forward requests to arbitrary external or internal systems.
{
"affected": [],
"aliases": [
"CVE-2025-2245"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-04T10:15:16Z",
"severity": "MODERATE"
},
"details": "A server-side request forgery (SSRF) vulnerability exists in the Bitdefender GravityZone Update Server when operating in Relay Mode. The HTTP proxy component on port 7074 uses a domain allowlist to restrict outbound requests, but fails to properly sanitize hostnames containing null-byte (%00) sequences. By crafting a request to a domain such as evil.com%00.bitdefender.com, an attacker can bypass the allowlist check, causing the proxy to forward requests to arbitrary external or internal systems.",
"id": "GHSA-gv8r-56hq-95m6",
"modified": "2025-08-22T00:30:31Z",
"published": "2025-04-04T12:30:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2245"
},
{
"type": "WEB",
"url": "https://www.bitdefender.com/support/security-advisories/server-side-request-forgery-in-gravityzone-update-server-using-null-bytes-va-12646"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-GVWH-C4R7-8FM9
Vulnerability from github – Published: 2024-11-15 12:31 – Updated: 2024-11-15 12:31A Server-Side Request Forgery (SSRF) vulnerability was discovered in chatwoot/chatwoot, affecting all versions prior to 2.5.0. The vulnerability allows an attacker to upload an SVG file containing a malicious SSRF payload. When the SVG file is used as an avatar and opened in a new tab, it can trigger the SSRF, potentially leading to host redirection.
{
"affected": [],
"aliases": [
"CVE-2021-3742"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-15T11:15:05Z",
"severity": "HIGH"
},
"details": "A Server-Side Request Forgery (SSRF) vulnerability was discovered in chatwoot/chatwoot, affecting all versions prior to 2.5.0. The vulnerability allows an attacker to upload an SVG file containing a malicious SSRF payload. When the SVG file is used as an avatar and opened in a new tab, it can trigger the SSRF, potentially leading to host redirection.",
"id": "GHSA-gvwh-c4r7-8fm9",
"modified": "2024-11-15T12:31:44Z",
"published": "2024-11-15T12:31:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3742"
},
{
"type": "WEB",
"url": "https://github.com/chatwoot/chatwoot/commit/6fdd4a29969be8423f31890b807d27d13627c50c"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/1625472546121-chatwoot/chatwoot"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:A/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-GW4J-4229-Q4PX
Vulnerability from github – Published: 2022-03-18 17:56 – Updated: 2022-03-18 17:56In Apache Dubbo prior to 2.6.9 and 2.7.10, the usage of parseURL method will lead to the bypass of white host check which can cause open redirect or SSRF vulnerability.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.dubbo:dubbo"
},
"ranges": [
{
"events": [
{
"introduced": "2.5.0"
},
{
"fixed": "2.7.10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.alibaba:dubbo"
},
"ranges": [
{
"events": [
{
"introduced": "2.5.0"
},
{
"fixed": "2.6.9"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-25640"
],
"database_specific": {
"cwe_ids": [
"CWE-601",
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2021-06-02T19:51:25Z",
"nvd_published_at": "2021-06-01T14:15:00Z",
"severity": "MODERATE"
},
"details": "In Apache Dubbo prior to 2.6.9 and 2.7.10, the usage of parseURL method will lead to the bypass of white host check which can cause open redirect or SSRF vulnerability.",
"id": "GHSA-gw4j-4229-q4px",
"modified": "2022-03-18T17:56:45Z",
"published": "2022-03-18T17:56:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25640"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/re4cab8855361a454d2af106fb3dad76259e723015fd7e09cb4f9eb77%40%3Cdev.dubbo.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/re4cab8855361a454d2af106fb3dad76259e723015fd7e09cb4f9eb77@%3Cdev.dubbo.apache.org%3E"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Server-Side Request Forgery in Apache Dubbo"
}
GHSA-GW7H-FW8W-32JC
Vulnerability from github – Published: 2022-03-19 00:00 – Updated: 2022-03-26 00:00An issue was discovered in MISP before 2.4.156. app/Model/Server.php does not restrict generateServerSettings to the CLI. This could lead to SSRF.
{
"affected": [],
"aliases": [
"CVE-2022-27245"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-03-18T18:15:00Z",
"severity": "HIGH"
},
"details": "An issue was discovered in MISP before 2.4.156. app/Model/Server.php does not restrict generateServerSettings to the CLI. This could lead to SSRF.",
"id": "GHSA-gw7h-fw8w-32jc",
"modified": "2022-03-26T00:00:42Z",
"published": "2022-03-19T00:00:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27245"
},
{
"type": "WEB",
"url": "https://github.com/MISP/MISP/commit/8dcf414340c5ddedfebbc972601646d38e1d0717"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-GW98-8MFF-5X24
Vulnerability from github – Published: 2025-01-15 00:30 – Updated: 2025-01-31 21:32MSFM before v2025.01.01 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /file/download.
{
"affected": [],
"aliases": [
"CVE-2024-57767"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-15T00:15:34Z",
"severity": "HIGH"
},
"details": "MSFM before v2025.01.01 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /file/download.",
"id": "GHSA-gw98-8mff-5x24",
"modified": "2025-01-31T21:32:45Z",
"published": "2025-01-15T00:30:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-57767"
},
{
"type": "WEB",
"url": "https://gitee.com/wanglingxiao/mysiteforme/issues/IBFVM9"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GWPM-3V8H-J4WH
Vulnerability from github – Published: 2022-05-24 17:07 – Updated: 2022-05-24 17:07An authenticated server-side request forgery in Nextcloud server 16.0.1 allowed to detect local and remote services when adding a new subscription in the calendar application.
{
"affected": [],
"aliases": [
"CVE-2020-8118"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-02-04T20:15:00Z",
"severity": "MODERATE"
},
"details": "An authenticated server-side request forgery in Nextcloud server 16.0.1 allowed to detect local and remote services when adding a new subscription in the calendar application.",
"id": "GHSA-gwpm-3v8h-j4wh",
"modified": "2022-05-24T17:07:59Z",
"published": "2022-05-24T17:07:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8118"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/427835"
},
{
"type": "WEB",
"url": "https://nextcloud.com/security/advisory/?id=NC-SA-2019-014"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00019.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00022.html"
}
],
"schema_version": "1.4.0",
"severity": []
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.