Description

SSRF as in Server Side Request Forgery is a vulnerability that allows an attacker to force server interfaces into sending packets initiated by the victim server to the local interface or to another server behind the firewall. Consult Web References for more information about this problem.

Remediation

Properly sanitize user requests or use a special sandboxed host to route requests to remote resources

References

HTTP/2: The Sequel is Always Worse

Weird proxies/2 and a bit of magic

SSRF VS. BUSINESS-CRITICAL APPLICATIONS

Related Vulnerabilities

WordPress 4.5.x Multiple Vulnerabilities (4.5 - 4.5.18)

WordPress Plugin Essential Addons for Elementor Server-Side Request Forgery (2.9.8)

WordPress Plugin Nelio AB Testing Server-Side Request Forgery (4.5.10)

WordPress Plugin Essential Addons for Elementor Server-Side Request Forgery (2.9.8)

WordPress Plugin jRSS Widget Server-Side Request Forgery (1.2)

Severity

High

Classification

CWE-918 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Tags

SSRF Acumonitor