CWE-918Server-Side Request Forgery (SSRF)

Description

Common consequences· 3

• Confidentiality — Read Application Data
• Integrity — Execute Unauthorized Code or Commands
• Access Control — Bypass Protection Mechanism
  By providing URLs to unexpected hosts or ports, attackers can make it appear that the server is sending the request, possibly bypassing access controls such as firewalls that prevent the attackers from accessing the URLs directly. The server can be used as a proxy to conduct port scanning of hosts in internal networks, use other URLs such as that can access documents on the system (using file://), or use other protocols such as gopher:// or tftp://, which may provide greater control over the contents of requests.

Related CAPEC attack patterns· 1

Exploits (incoming)1

Compliance frameworks addressing this (incoming)3

(incoming)146

Showing top 30 of 146 by confidence. Click any target to see the full neighbourhood.

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.