Sign in Sign up
JA · EN · FR
SecPulse

Server-Side Request Forgery

⚔️ Attack Types Related 856
slug: ssrf

Explanation

SSRFは「外部からのリクエストを、サーバーが内部ネットワークに転送してしまう」脆弱性です。 たとえば「画像URLを貼って」と言われてWebサービスがそのURLを取りに行く機能で、攻撃者が `http://169.254.169.254/` (AWSの内部メタデータURL) を入れると、AWSの認証情報が漏洩する、というのが典型例。 クラウド時代に特に危険視されている脆弱性です。
📌 Example
Capital One事件 (2019, 1億人の個人情報流出): WAFのSSRF脆弱性経由でAWS認証情報が窃取され、S3バケットから個人情報を全件取られた。

🔖 Related tags

Denial of Service8713 Cross-Site Scripting8075 SQL Injection3881 Remote Code Execution2906 Path Traversal2053 Privilege Escalation1503 Cross-Site Request Forgery1068 Authentication Bypass853 Insecure Deserialization739 Buffer Overflow77 Command Injection28 Use After Free20 Credential Leak14 Prototype Pollution7 Integer Overflow7

🛡 Vulnerabilities tagged with this 858

Image ID Title
CVE-2026-59970 SSRF (Server-Side Request Forgery) in Tandoor Recipes (CVE-2026-59970)
CVE-2026-101300 Server-Side Request Forgery (SSRF) reported in the ticket sales chart PDF export functionality of...
CVE-2026-39989 SSRF (Server-Side Request Forgery) in Download Station (CVE-2026-39989)
CVE-2026-109430 XXE (XML External Entity) in Ellucian WebAdvisor (CVE-2026-109430)
CVE-2026-91184 Vulnerability in Description NGINX Gateway Fabric (CVE-2026-91184)
CVE-2026-78231 When OpenID sign-in is enabled, Gitea processes unauthenticated assertion parameters and sends an HTTP POST request to…
CVE-2026-85345 SSRF (Server-Side Request Forgery) in FV Flowplayer Video Player (WordPress plugin) (CVE-2026-85345)
CVE-2026-95634 SSRF (Server-Side Request Forgery) in CAI Content Credentials (CVE-2026-95634)
CVE-2026-76001 SSRF (Server-Side Request Forgery) in ColdFusion (CVE-2026-76001)
CVE-2026-75748 SSRF (Server-Side Request Forgery) in ColdFusion (CVE-2026-75748)
CVE-2026-34633 SSRF (Server-Side Request Forgery) in ColdFusion (CVE-2026-34633)
CVE-2026-34634 SSRF (Server-Side Request Forgery) in ColdFusion (CVE-2026-34634)
CVE-2026-106622 SSRF (Server-Side Request Forgery) in Adobe Coldfusion (CVE-2026-106622)
CVE-2026-105897 SSRF (Server-Side Request Forgery) in Adobe Coldfusion (CVE-2026-105897)
CVE-2026-96204 SSRF (Server-Side Request Forgery) in Microsoft Azure Arc (CVE-2026-96204)
CVE-2026-88206 SSRF (Server-Side Request Forgery) in Microsoft Sharepoint Server (CVE-2026-88206)
CVE-2026-70259 SSRF (Server-Side Request Forgery) in Microsoft Sharepoint Server (CVE-2026-70259)
CVE-2026-70251 SSRF (Server-Side Request Forgery) in Microsoft Sharepoint Server (CVE-2026-70251)
CVE-2026-70202 SSRF (Server-Side Request Forgery) in Microsoft Sharepoint Server (CVE-2026-70202)
CVE-2026-110240 SSRF (Server-Side Request Forgery) in Lancet (CVE-2026-110240)
CVE-2026-110223 SSRF (Server-Side Request Forgery) in Kavita (CVE-2026-110223)
CVE-2026-105713 SSRF (Server-Side Request Forgery) in Microsoft Sharepoint Server (CVE-2026-105713)
CVE-2026-107460 SSRF (Server-Side Request Forgery) in Apache (CVE-2026-107460)
CVE-2024-34319 A Server-Side Request Forgery (SSRF) in the serviceURL parameter of ProPhoenix Law RMS v2022.2403...
CVE-2026-89111 SSRF (Server-Side Request Forgery) in SAP Cloud SDK for Python (CVE-2026-89111)
CVE-2026-85471 SSRF (Server-Side Request Forgery) in Quay (CVE-2026-85471)
CVE-2026-75888 SSRF (Server-Side Request Forgery) in OpenShift console (CVE-2026-75888)
CVE-2026-62030 SSRF (Server-Side Request Forgery) in StreamCast (CVE-2026-62030)
CVE-2026-27350 SSRF (Server-Side Request Forgery) in Builderius (CVE-2026-27350)
CVE-2026-78024 SSRF (Server-Side Request Forgery) in Dell Policy Manager For Secure Connect Gateway (CVE-2026-78024)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details