Sign in Sign up
JA · EN · FR
SecPulse

Server-Side Request Forgery

⚔️ Attack Types Related 856
slug: ssrf

Explanation

SSRFは「外部からのリクエストを、サーバーが内部ネットワークに転送してしまう」脆弱性です。 たとえば「画像URLを貼って」と言われてWebサービスがそのURLを取りに行く機能で、攻撃者が `http://169.254.169.254/` (AWSの内部メタデータURL) を入れると、AWSの認証情報が漏洩する、というのが典型例。 クラウド時代に特に危険視されている脆弱性です。
📌 Example
Capital One事件 (2019, 1億人の個人情報流出): WAFのSSRF脆弱性経由でAWS認証情報が窃取され、S3バケットから個人情報を全件取られた。

🔖 Related tags

Denial of Service8713 Cross-Site Scripting8075 SQL Injection3881 Remote Code Execution2906 Path Traversal2053 Privilege Escalation1503 Cross-Site Request Forgery1068 Authentication Bypass853 Insecure Deserialization739 Buffer Overflow77 Command Injection28 Use After Free20 Credential Leak14 Prototype Pollution7 Integer Overflow7

🛡 Vulnerabilities tagged with this 858

Image ID Title
CVE-2025-0474 SSRF (Server-Side Request Forgery) in Invoice Ninja (CVE-2025-0474)
CVE-2024-55875 Information Disclosure in org.http4k:http4k-format-xml (CVE-2024-55875)
CVE-2024-42467 SSRF (Server-Side Request Forgery) in org.openhab.ui.bundles:org.openhab.ui.cometvisu (CVE-2024-42467)
CVE-2024-21527 Versions of the package github.com/gotenberg/gotenberg/v8/pkg/gotenberg before 8.1.0; versions of the package…
CVE-2024-25294 SSRF (Server-Side Request Forgery) in REBUILD (CVE-2024-25294)
CVE-2024-22873 SSRF (Server-Side Request Forgery) in Tencent Blueking CMDB (CVE-2024-22873)
CVE-2023-36088 SSRF (Server-Side Request Forgery) in NebulaGraph Studio (CVE-2023-36088)
CVE-2022-44729 SSRF (Server-Side Request Forgery) in Apache (CVE-2022-44729)
CVE-2023-35175 SSRF (Server-Side Request Forgery) in W1A75A Firmware (CVE-2023-35175)
CVE-2023-27162 SSRF (Server-Side Request Forgery) in openapi-generator (CVE-2023-27162)
CVE-2023-27163 SSRF (Server-Side Request Forgery) in request-baskets (CVE-2023-27163)
CVE-2023-27159 SSRF (Server-Side Request Forgery) in Appwrite (CVE-2023-27159)
CVE-2023-27160 SSRF (Server-Side Request Forgery) in forem (CVE-2023-27160)
CVE-2023-1725 SSRF (Server-Side Request Forgery) in Project Management System (CVE-2023-1725)
CVE-2023-25262 SSRF (Server-Side Request Forgery) in Stimulsoft GmbH Stimulsoft Designer (CVE-2023-25262)
CVE-2023-27161 SSRF (Server-Side Request Forgery) in Jellyfin (CVE-2023-27161)
CVE-2022-45085 SSRF (Server-Side Request Forgery) in Smartpower Web (CVE-2022-45085)
CVE-2021-37498 SSRF (Server-Side Request Forgery) in Reprisesoftware (CVE-2021-37498)
CVE-2022-42343 SSRF (Server-Side Request Forgery) in Adobe Windows (CVE-2022-42343)
CVE-2022-40842 SSRF (Server-Side Request Forgery) in Ndk Design (CVE-2022-40842)
CVE-2022-38580 SSRF (Server-Side Request Forgery) in Zalando Skipper (CVE-2022-38580)
CVE-2022-36551 SSRF (Server-Side Request Forgery) in label-studio (CVE-2022-36551)
CVE-2021-21009 SSRF (Server-Side Request Forgery) in Adobe Windows (CVE-2021-21009)
CVE-2020-24815 SSRF (Server-Side Request Forgery) in Microstrategy (CVE-2020-24815)
CVE-2020-28043 SSRF (Server-Side Request Forgery) in MISP (CVE-2020-28043)
CVE-2020-24881 SSRF (Server-Side Request Forgery) in Enhancesoft (CVE-2020-24881)
CVE-2020-25466 SSRF (Server-Side Request Forgery) in CRMEB (CVE-2020-25466)
CVE-2020-22983 SSRF (Server-Side Request Forgery) in MicroStrategy Web SDK (CVE-2020-22983)
CVE-2022-27245 SSRF (Server-Side Request Forgery) in MISP (CVE-2022-27245)
CVE-2021-42637 SSRF (Server-Side Request Forgery) in PrinterLogic Web Stack (CVE-2021-42637)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details