Sign in Sign up
JA · EN · FR
SecPulse

Server-Side Request Forgery

⚔️ Attack Types Related 856
slug: ssrf

Explanation

SSRFは「外部からのリクエストを、サーバーが内部ネットワークに転送してしまう」脆弱性です。 たとえば「画像URLを貼って」と言われてWebサービスがそのURLを取りに行く機能で、攻撃者が `http://169.254.169.254/` (AWSの内部メタデータURL) を入れると、AWSの認証情報が漏洩する、というのが典型例。 クラウド時代に特に危険視されている脆弱性です。
📌 Example
Capital One事件 (2019, 1億人の個人情報流出): WAFのSSRF脆弱性経由でAWS認証情報が窃取され、S3バケットから個人情報を全件取られた。

🔖 Related tags

Denial of Service8713 Cross-Site Scripting8075 SQL Injection3881 Remote Code Execution2906 Path Traversal2053 Privilege Escalation1503 Cross-Site Request Forgery1068 Authentication Bypass853 Insecure Deserialization739 Buffer Overflow77 Command Injection28 Use After Free20 Credential Leak14 Prototype Pollution7 Integer Overflow7

🛡 Vulnerabilities tagged with this 858

Image ID Title
CVE-2026-69192 Vulnerability in ip-address (CVE-2026-69192)
CVE-2026-69198 Vulnerability in ip-address (CVE-2026-69198)
CVE-2026-52371 A Server-Side Request Forgery (SSRF) in the xxl-job-admin/jobinfo/trigger component of xxl-job v3...
CVE-2026-57232 SSRF (Server-Side Request Forgery) in contao/contao (CVE-2026-57232)
CVE-2026-54729 SSRF (Server-Side Request Forgery) in dssrf (CVE-2026-54729)
CVE-2026-18446 Vulnerability in fast-uri (CVE-2026-18446)
CVE-2026-14540 SSRF (Server-Side Request Forgery) in Google mcp-toolbox (CVE-2026-14540)
CVE-2026-15974 SSRF (Server-Side Request Forgery) in SGLang (CVE-2026-15974)
CVE-2026-67530 WACRM is a self-hostable CRM template for WhatsApp. In 0.7.0 and earlier, the automation send_webhook action in…
CVE-2026-57862 SSRF (Server-Side Request Forgery) in Kanboard (CVE-2026-57862)
CVE-2026-54722 Vulnerability in dssrf (CVE-2026-54722)
CVE-2026-14980 Privilege Escalation in IBM WebSphere Application Server - Liberty (CVE-2026-14980)
CVE-2026-18369 SSRF (Server-Side Request Forgery) in Dogtag PKI's ACME responder (CVE-2026-18369)
CVE-2026-67428 SSRF (Server-Side Request Forgery) in flyto-core (CVE-2026-67428)
CVE-2026-67425 Vulnerability in flyto-core (CVE-2026-67425)
CVE-2026-67201 V through 0.5.2, fixed in commit 85859f0, contains a server-side request forgery (SSRF) bypass...
CVE-2026-67426 Vulnerability in flyto-core (CVE-2026-67426)
CVE-2026-14529 Vulnerability in IBM WebSphere Application Server (CVE-2026-14529)
CVE-2026-6089 SSRF (Server-Side Request Forgery) in WP CTA (WordPress plugin) (CVE-2026-6089)
CVE-2026-58189 SSRF (Server-Side Request Forgery) in Apache (CVE-2026-58189)
CVE-2026-23904 Vulnerability in Apache (CVE-2026-23904)
CVE-2026-65442 SSRF (Server-Side Request Forgery) in FormCraft (CVE-2026-65442)
CVE-2026-61953 SSRF (Server-Side Request Forgery) in Simple Link Directory Pro (CVE-2026-61953)
CVE-2026-65924 SSRF (Server-Side Request Forgery) in Jfrog (CVE-2026-65924)
CVE-2026-16481 SSRF (Server-Side Request Forgery) in Google Mcp Toolbox For Databases (CVE-2026-16481)
CVE-2026-54272 Vulnerability in ip-address (CVE-2026-54272)
CVE-2026-65558 SSRF (Server-Side Request Forgery) in AffiliateX (CVE-2026-65558)
CVE-2026-66437 SSRF (Server-Side Request Forgery) in Feedzy (CVE-2026-66437)
CVE-2026-59552 Unauthenticated Server Side Request Forgery (SSRF) in 3D Flipbook PDF Viewer &amp; Embedder <= 1...
CVE-2026-57917 proCertum SmartSign parses external XML entities from arbitrary crafted signature files, enabling...

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details