1539 vulnerabilities classified as CWE-918 (服务端请求伪造(SSRF)). AI Chinese analysis included.
CWE-918, Server-Side Request Forgery, is a critical web security weakness where an application allows users to specify URLs that the server subsequently fetches without adequate validation. Attackers typically exploit this by manipulating input parameters to force the server to access internal resources, such as cloud metadata services or local network endpoints, which are otherwise inaccessible from the outside. This bypasses perimeter defenses, potentially leading to sensitive data exposure or internal network reconnaissance. To mitigate SSRF, developers must implement strict input validation, ensuring that only whitelisted domains and protocols are permitted. Additionally, employing network-level controls like firewalls to restrict outbound connections from the application server and isolating internal services from public-facing interfaces significantly reduces the attack surface, preventing unauthorized internal access.
$url = $_GET['url']; # User-controlled input # Fetch the content of the provided URL $response = file_get_contents($url); echo $response;# Define allowed URLs (or domains) $allowed_urls = [ 'https://example.com/data.json', 'https://api.example.com/info', ]; # Get the user-provided URL $url = $_GET['url'] ?? ''; # Validate against allowed URLs if (!in_array($url, $allowed_urls)) { http_response_code(400); echo "Invalid or unauthorized URL."; exit; } # Fetch content safely $response = @file_get_contents($url); if ($response === false) { http_response_code(500); echo "Failed to fetch content."; exit; } echo htmlspecialchars($response); # Escape output for safety| CVE ID | Title | CVSS | Severity | Published |
|---|---|---|---|---|
| CVE-2017-15886 | Synology Chat Link Preview 安全漏洞 — Chat | 6.5 | - | 2017-12-28 |
| CVE-2017-0889 | thoughtbot Paperclip ruby gem 安全漏洞 — paperclip ruby gem | 7.5 | - | 2017-11-13 |
| CVE-2017-0905 | Recurly Client Ruby Library 安全漏洞 — recurly ruby gem | 9.8 | - | 2017-11-13 |
| CVE-2017-0906 | Recurly Client Python Library 安全漏洞 — recurly python module | 9.8 | - | 2017-11-13 |
| CVE-2017-0907 | Recurly Client .NET Library 安全漏洞 — recurly-api-client .NET library | 9.8 | - | 2017-11-13 |
| CVE-2017-12071 | Synology Photo Station 安全漏洞 — Synology Photo Station | 6.5 | - | 2017-09-08 |
| CVE-2017-11149 | Synology Download Station 安全漏洞 — Synology Download Station | 6.5 | - | 2017-08-14 |
| CVE-2017-11148 | Synology Chat 安全漏洞 — Synology Chat | 4.3 | - | 2017-08-11 |
| CVE-2017-6036 | Belden Hirschmann GECKO Lite Managed Switch 信息泄露漏洞 — Belden Hirschmann GECKO | 8.1 | - | 2017-06-30 |
Vulnerabilities classified as CWE-918 (服务端请求伪造(SSRF)) represent 1539 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.