CWE-918 — Server-Side Request Forgery (SSRF)
CWE-918: Server-Side Request Forgery (SSRF)
MITRE CWE weakness
| Kind | Weakness |
| Abstraction | Base |
| Status | Incomplete |
| Likelihood of exploit | — |
Description
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Common consequences
- Confidentiality: Read Application Data
- Integrity: Execute Unauthorized Code or Commands
- Access Control: Bypass Protection Mechanism
Mitigations
(none listed)
References
- CWE page: https://cwe.mitre.org/data/definitions/918.html
- CWE list: https://cwe.mitre.org/data/index.html