Sign in Sign up
JA · EN · FR
SecPulse

Server-Side Request Forgery

⚔️ Attack Types Related 856
slug: ssrf

Explanation

SSRFは「外部からのリクエストを、サーバーが内部ネットワークに転送してしまう」脆弱性です。 たとえば「画像URLを貼って」と言われてWebサービスがそのURLを取りに行く機能で、攻撃者が `http://169.254.169.254/` (AWSの内部メタデータURL) を入れると、AWSの認証情報が漏洩する、というのが典型例。 クラウド時代に特に危険視されている脆弱性です。
📌 Example
Capital One事件 (2019, 1億人の個人情報流出): WAFのSSRF脆弱性経由でAWS認証情報が窃取され、S3バケットから個人情報を全件取られた。

🔖 Related tags

Denial of Service8713 Cross-Site Scripting8075 SQL Injection3881 Remote Code Execution2906 Path Traversal2053 Privilege Escalation1503 Cross-Site Request Forgery1068 Authentication Bypass853 Insecure Deserialization739 Buffer Overflow77 Command Injection28 Use After Free20 Credential Leak14 Prototype Pollution7 Integer Overflow7

🛡 Vulnerabilities tagged with this 858

Image ID Title
CVE-2026-82443 SSRF (Server-Side Request Forgery) in Adobe Windows (CVE-2026-82443)
CVE-2026-79913 Vulnerability in github.com/cloudreve/Cloudreve/v4 (CVE-2026-79913)
CVE-2026-88403 A Server-Side Request Forgery (SSRF) in the serverRequest function of nocobase v2.1.21 allows...
CVE-2026-61612 SSRF (Server-Side Request Forgery) in @aborruso/ckan-mcp-server (CVE-2026-61612)
CVE-2026-55473 SSRF (Server-Side Request Forgery) in HomeBox (CVE-2026-55473)
CVE-2026-36469 CuteNews v.2.1.2 is vulnerable to Server-Side Request Forgery (SSRF) in core/modules/media.php --...
CVE-2026-75885 SSRF (Server-Side Request Forgery) in OpenShift console (CVE-2026-75885)
CVE-2026-76900 SSRF (Server-Side Request Forgery) in CordysCRM (CVE-2026-76900)
CVE-2026-93597 SSRF (Server-Side Request Forgery) in ArcadeDB (CVE-2026-93597)
CVE-2026-40537 SSRF (Server-Side Request Forgery) in Synology DiskStation Manager (CVE-2026-40537)
CVE-2026-67101 SSRF (Server-Side Request Forgery) in HCL BigFix Service Management (CVE-2026-67101)
CVE-2026-77164 Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before...
CVE-2026-85917 SSRF (Server-Side Request Forgery) in Azure AI Foundry (CVE-2026-85917)
CVE-2026-81446 SSRF (Server-Side Request Forgery) in Dell OpenManage Server Administrator (CVE-2026-81446)
CVE-2026-81443 SSRF (Server-Side Request Forgery) in Dell OpenManage Server Administrator (CVE-2026-81443)
CVE-2026-66608 Contributor Server Side Request Forgery (SSRF) in Unlimited Elements For Elementor (Free Widgets,...
CVE-2026-92932 In the MISP sachertortephp library, the Xml::build() static method in lib/Cake/Utility/Xml.php...
CVE-2026-76425 SQL Injection in Cisco Identity Services Engine (CVE-2026-76425)
CVE-2026-92808 Vulnerability in Altium Enterprise Server (CVE-2026-92808)
CVE-2026-88592 kkFileView >= 4.2.0 is vulnerable to Server-Side Request Forgery (SSRF). The cross-origin file...
CVE-2026-76680 SSRF (Server-Side Request Forgery) in Arubanetworks (CVE-2026-76680)
CVE-2026-90971 Authorization Flaw in Devolutions Server (CVE-2026-90971)
CVE-2026-91938 SSRF (Server-Side Request Forgery) in Flowise (CVE-2026-91938)
CVE-2026-77866 Vulnerability in Slab safeurl (CVE-2026-77866)
CVE-2026-79425 An authenticated Server-Side Request Forgery (SSRF) in the /adminapi/file/online_upload component...
CVE-2026-91750 SSRF (Server-Side Request Forgery) in WeKnora (CVE-2026-91750)
CVE-2026-12944 SSRF (Server-Side Request Forgery) in IBM Langflow OSS (CVE-2026-12944)
CVE-2026-12765 SSRF (Server-Side Request Forgery) in IBM Langflow OSS (CVE-2026-12765)
CVE-2026-12766 SSRF (Server-Side Request Forgery) in IBM Langflow OSS (CVE-2026-12766)
CVE-2026-12767 SSRF (Server-Side Request Forgery) in IBM Langflow OSS (CVE-2026-12767)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details