Description
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
SSRF Vulnerability Guide
Read our in-depth guide on exploiting and mitigating this weakness
Potential Impact
Confidentiality
Read Application Data
Integrity
Execute Unauthorized Code or Commands
Access Control
Bypass Protection Mechanism
Demonstrative Examples
$url = $_GET['url'];# User-controlled input
# Fetch the content of the provided URL
$response = file_get_contents($url);
echo $response;# Define allowed URLs (or domains)$allowed_urls = ['https://example.com/data.json','https://api.example.com/info',];# Get the user-provided URL$url = $_GET['url'] ?? '';# Validate against allowed URLsif (!in_array($url, $allowed_urls)) {http_response_code(400);echo "Invalid or unauthorized URL.";exit;}# Fetch content safely$response = @file_get_contents($url);if ($response === false) {http_response_code(500);echo "Failed to fetch content.";exit;}echo htmlspecialchars($response);# Escape output for safetyDetection Methods
- Automated Static Analysis High — Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then sea
Real-World CVE Examples
| CVE ID | Description |
|---|---|
| CVE-2026-33626 | SSRF in LLM toolkit accesses arbitrary URLs for images, as exploited in the wild in April 2026 to conduct port scanning [REF-1519] |
| CVE-2024-3095 | SSRF in LLM application development framework because the URL retriever allows connections to local addresses using a crafted Location header |
| CVE-2023-32786 | Chain: LLM integration framework has prompt injection (CWE-1427) that allows an attacker to force the service to retrieve data from an arbitrary URL, essentially providing SSRF (CWE-918) a |
| CVE-2021-26855 | Server Side Request Forgery (SSRF) in mail server, as exploited in the wild per CISA KEV. |
| CVE-2021-21973 | Server Side Request Forgery in cloud platform, as exploited in the wild per CISA KEV. |
| CVE-2016-4029 | Chain: incorrect validation of intended decimal-based IP address format (CWE-1286) enables parsing of octal or hexadecimal formats (CWE-1389), allowing bypass of an SSRF protection mechanism (CWE-918) |
| CVE-2002-1484 | Web server allows attackers to request a URL from another server, including other ports, which allows proxied scanning. |
| CVE-2004-2061 | CGI script accepts and retrieves incoming URLs. |
| CVE-2010-1637 | Web-based mail program allows internal network scanning using a modified POP3 port number. |
| CVE-2009-0037 | URL-downloading library automatically follows redirects to file:// and scp:// URLs |
Related Weaknesses
Frequently Asked Questions
What is CWE-918?
CWE-918 (Server-Side Request Forgery (SSRF)) is a software weakness identified by MITRE's Common Weakness Enumeration. It is classified as a Base-level weakness. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected d...
How can CWE-918 be exploited?
Attackers can exploit CWE-918 (Server-Side Request Forgery (SSRF)) to read application data. This weakness is typically introduced during the Architecture and Design, Implementation phase of software development.
How do I prevent CWE-918?
Follow secure coding practices, conduct code reviews, and use automated security testing tools (SAST/DAST) to detect this weakness early in the development lifecycle.
What is the severity of CWE-918?
CWE-918 is classified as a Base-level weakness (Medium abstraction). It has been observed in 10 real-world CVEs.