CWE-918 服务端请求伪造(SSRF) 类弱点 1584 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-918 服务端请求伪造（SSRF）是一种允许攻击者诱导服务器发起恶意请求的漏洞。当服务器接收外部提供的 URL 并据此获取内容时，若未严格校验目标地址，攻击者可构造请求访问内网资源或探测内部服务，从而绕过防火墙限制。开发者应实施严格的白名单机制，限制协议类型，禁用重定向，并对所有输入进行深度验证，确保请求仅能访问预期的合法外部资源，从而有效防御此类攻击。
$url = $_GET['url']; # User-controlled input # Fetch the content of the provided URL $response = file_get_contents($url); echo $response;# Define allowed URLs (or domains) $allowed_urls = [ 'https://example.com/data.json', 'https://api.example.com/info', ]; # Get the user-provided URL $url = $_GET['url'] ?? ''; # Validate against allowed URLs if (!in_array($url, $allowed_urls)) { http_response_code(400); echo "Invalid or unauthorized URL."; exit; } # Fetch content safely $response = @file_get_contents($url); if ($response === false) { http_response_code(500); echo "Failed to fetch content."; exit; } echo htmlspecialchars($response); # Escape output for safety| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2024-47208 | Apache OFBiz 代码问题漏洞 — Apache OFBiz | 9.8AI | CriticalAI | 2024-11-18 |
| CVE-2021-3742 | Chatwoot 代码问题漏洞 — chatwoot/chatwoot | 5.4AI | MediumAI | 2024-11-15 |
| CVE-2024-5917 | Palo Alto Networks PAN-OS 代码问题漏洞 — Cloud NGFW | 5.3AI | MediumAI | 2024-11-14 |
| CVE-2024-49521 | Adobe Commerce 安全漏洞 — Adobe Commerce | 7.7 | High | 2024-11-12 |
| CVE-2024-51785 | WordPress plugin Responsive Filterable Portfolio 代码问题漏洞 — Responsive Filterable Portfolio | 4.4 | Medium | 2024-11-09 |
| CVE-2024-10814 | WordPress plugin Code Embed 代码问题漏洞 — Code Embed | 6.4 | Medium | 2024-11-09 |
| CVE-2024-51740 | Combodo iTop 代码问题漏洞 — iTop | 4.3 | Medium | 2024-11-05 |
| CVE-2024-51665 | WordPress plugin Magical Addons For Elementor 代码问题漏洞 — Magical Addons For Elementor | 4.9 | Medium | 2024-11-04 |
| CVE-2024-49312 | WordPress plugin Edwiser Bridge 代码问题漏洞 — Edwiser Bridge | 4.9 | Medium | 2024-10-17 |
| CVE-2012-10018 | WordPress plugin Mapplic and Mapplic Lite 代码问题漏洞 — Mapplic Lite | 8.3 | High | 2024-10-16 |
| CVE-2024-47830 | Plane 安全漏洞 — plane | 9.3 | Critical | 2024-10-11 |
| CVE-2024-45317 | SonicWALL SMA1000 代码问题漏洞 — SMA1000 | 7.5AI | HighAI | 2024-10-11 |
| CVE-2024-47167 | Gradio 安全漏洞 — gradio | 9.8AI | CriticalAI | 2024-10-10 |
| CVE-2024-8977 | GitLab Enterprise Edition 安全漏洞 — GitLab | 8.2 | High | 2024-10-10 |
| CVE-2024-45119 | Adobe Commerce 代码问题漏洞 — Adobe Commerce | 4.9 | Medium | 2024-10-10 |
| CVE-2024-47008 | Ivanti Avalanche 安全漏洞 — Avalanche | 7.5 | High | 2024-10-08 |
| CVE-2024-9410 | Ada.cx 安全漏洞 — Ada.cx Sentry Component | 5.3 | Medium | 2024-10-04 |
| CVE-2024-45843 | Mattermost 代码问题漏洞 — Mattermost | 3.1 | Low | 2024-09-26 |
| CVE-2024-47066 | Lobe Chat 代码问题漏洞 — lobe-chat | 9.0 | Critical | 2024-09-23 |
| CVE-2024-43989 | WordPress plugin Firsh Justified Image Grid 代码问题漏洞 — Justified Image Grid | 7.5 | High | 2024-09-22 |
| CVE-2022-25777 | Mautic 安全漏洞 — Mautic | 6.5 | Medium | 2024-09-18 |
| CVE-2024-38183 | Microsoft GroupMe 代码问题漏洞 — GroupMe | 9.8 | Critical | 2024-09-17 |
| CVE-2024-6587 | LiteLLM 代码问题漏洞 — berriai/litellm | 8.1AI | HighAI | 2024-09-13 |
| CVE-2024-8635 | GitLab 安全漏洞 — GitLab | 7.7 | High | 2024-09-12 |
| CVE-2021-38132 | OpenText eDirectory 安全漏洞 — eDirectory | 5.3 | Medium | 2024-09-12 |
| CVE-2024-24759 | MindsDB 安全漏洞 — mindsdb | 9.3 | Critical | 2024-09-05 |
| CVE-2024-45507 | Apache OFBiz 代码问题漏洞 — Apache OFBiz | 9.8AI | CriticalAI | 2024-09-04 |
| CVE-2024-43371 | CKAN 安全漏洞 — ckan | 4.5 | Medium | 2024-08-21 |
| CVE-2024-43379 | TruffleHog 安全漏洞 — trufflehog | 3.4 | Low | 2024-08-19 |
| CVE-2022-1751 | WordPress plugin Skitter Slideshow 安全漏洞 — Skitter Slideshow | 7.2 | High | 2024-08-17 |
CWE-918（服务端请求伪造(SSRF)） 是常见的弱点类别，本平台收录该类弱点关联的 1584 条 CVE 漏洞。