Sign in Sign up
JA · EN · FR
SecPulse

Server-Side Request Forgery

⚔️ Attack Types Related 856
slug: ssrf

Explanation

SSRFは「外部からのリクエストを、サーバーが内部ネットワークに転送してしまう」脆弱性です。 たとえば「画像URLを貼って」と言われてWebサービスがそのURLを取りに行く機能で、攻撃者が `http://169.254.169.254/` (AWSの内部メタデータURL) を入れると、AWSの認証情報が漏洩する、というのが典型例。 クラウド時代に特に危険視されている脆弱性です。
📌 Example
Capital One事件 (2019, 1億人の個人情報流出): WAFのSSRF脆弱性経由でAWS認証情報が窃取され、S3バケットから個人情報を全件取られた。

🔖 Related tags

Denial of Service8713 Cross-Site Scripting8075 SQL Injection3881 Remote Code Execution2906 Path Traversal2053 Privilege Escalation1503 Cross-Site Request Forgery1068 Authentication Bypass853 Insecure Deserialization739 Buffer Overflow77 Command Injection28 Use After Free20 Credential Leak14 Prototype Pollution7 Integer Overflow7

🛡 Vulnerabilities tagged with this 856

Image ID Title
CVE-2025-22726 SSRF (Server-Side Request Forgery) in nK Themes Helper (CVE-2025-22726)
CVE-2025-69222 SSRF (Server-Side Request Forgery) in LibreChat (CVE-2025-69222)
CVE-2026-22186 XXE (XML External Entity) in Bio-Formats (CVE-2026-22186)
CVE-2025-49335 Server-Side Request Forgery (SSRF) vulnerability in minnur External Media external-media allows Server Side Request…
CVE-2025-68437 SSRF (Server-Side Request Forgery) in Craft Cms (CVE-2025-68437)
CVE-2025-62088 SSRF (Server-Side Request Forgery) in WordPress (CVE-2025-62088)
CVE-2025-69014 SSRF (Server-Side Request Forgery) in Youzify (CVE-2025-69014)
CVE-2025-69206 SSRF (Server-Side Request Forgery) in Hemmelig (CVE-2025-69206)
CVE-2025-68893 SSRF (Server-Side Request Forgery) in WordPress Image shrinker (CVE-2025-68893)
CVE-2025-68600 SSRF (Server-Side Request Forgery) in Link Library (CVE-2025-68600)
CVE-2025-68500 SSRF (Server-Side Request Forgery) in Prime Slider – Addons For Elementor (CVE-2025-68500)
CVE-2025-67623 SSRF (Server-Side Request Forgery) in 6Storage Rentals (CVE-2025-67623)
CVE-2025-34452 Path Traversal in Streama (CVE-2025-34452)
CVE-2025-52196 SSRF (Server-Side Request Forgery) in Ctera Portal (CVE-2025-52196)
CVE-2025-13231 Vulnerability in Fancy Product Designer (WordPress plugin) (CVE-2025-13231)
CVE-2025-66407 Cross-Site Request Forgery (CSRF) in weblate (CVE-2025-66407)
CVE-2025-66844 SSRF (Server-Side Request Forgery) in Getgrav (CVE-2025-66844)
CVE-2025-13281 A half-blind Server Side Request Forgery (SSRF) vulnerability exists in kube-controller-manager when using the in-tree…
CVE-2025-67494 SSRF (Server-Side Request Forgery) in ZITADEL (CVE-2025-67494)
CVE-2025-63010 SSRF (Server-Side Request Forgery) in Hercules Core (CVE-2025-63010)
CVE-2025-12832 SSRF (Server-Side Request Forgery) in IBM InfoSphere Information Server (CVE-2025-12832)
CVE-2025-26487 SSRF (Server-Side Request Forgery) in Infinera MTC-9 (CVE-2025-26487)
CVE-2025-59775 SSRF (Server-Side Request Forgery) in Apache Http Server (CVE-2025-59775)
CVE-2025-13872 SSRF (Server-Side Request Forgery) in Objectplanet (CVE-2025-13872)
CVE-2025-66201 Vulnerability in LibreChat (CVE-2025-66201)
CVE-2025-64525 SSRF (Server-Side Request Forgery) in Astro is a web framework. In Astro (CVE-2025-64525)
CVE-2025-60898 SSRF (Server-Side Request Forgery) in Thumbnail (CVE-2025-60898)
CVE-2025-59837 Cross-Site Scripting (XSS) in Astro (CVE-2025-59837)
CVE-2025-36085 SSRF (Server-Side Request Forgery) in IBM Concert (CVE-2025-36085)
CVE-2025-62988 SSRF (Server-Side Request Forgery) in Slider Templates (CVE-2025-62988)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details