CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
6271 vulnerabilities reference this CWE, most recent first.
GHSA-5M98-V5JJ-6CV6
Vulnerability from github – Published: 2024-10-30 21:30 – Updated: 2024-10-31 21:31xtreme1 <= v0.9.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the /api/data/upload path. The vulnerability is triggered through the fileUrl parameter, which allows an attacker to make arbitrary requests to internal or external systems.
{
"affected": [],
"aliases": [
"CVE-2024-48346"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-30T21:15:14Z",
"severity": "MODERATE"
},
"details": "xtreme1 \u003c= v0.9.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the /api/data/upload path. The vulnerability is triggered through the fileUrl parameter, which allows an attacker to make arbitrary requests to internal or external systems.",
"id": "GHSA-5m98-v5jj-6cv6",
"modified": "2024-10-31T21:31:45Z",
"published": "2024-10-30T21:30:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48346"
},
{
"type": "WEB",
"url": "https://github.com/xtreme1-io/xtreme1/issues/284"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-5M9G-HH42-2P58
Vulnerability from github – Published: 2024-02-26 18:30 – Updated: 2024-08-06 00:31Tencent Blueking CMDB v3.2.x to v3.9.x was discovered to contain a Server-Side Request Forgery (SSRF) via the event subscription function (/service/subscription.go). This vulnerability allows attackers to access internal requests via a crafted POST request.
{
"affected": [],
"aliases": [
"CVE-2024-22873"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-26T16:27:56Z",
"severity": "HIGH"
},
"details": "Tencent Blueking CMDB v3.2.x to v3.9.x was discovered to contain a Server-Side Request Forgery (SSRF) via the event subscription function (/service/subscription.go). This vulnerability allows attackers to access internal requests via a crafted POST request.",
"id": "GHSA-5m9g-hh42-2p58",
"modified": "2024-08-06T00:31:19Z",
"published": "2024-02-26T18:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22873"
},
{
"type": "WEB",
"url": "https://gist.github.com/exp1orer/0f190c6a64b668a9b1c4c47789affa09"
},
{
"type": "WEB",
"url": "https://sphenoid-enquiry-9be.notion.site/BK-CMDB-SSRF-ba21e94f4976460188fa52d26c15a6ae?pvs=4"
},
{
"type": "WEB",
"url": "http://blueking.com"
},
{
"type": "WEB",
"url": "http://tencent.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-5MCQ-H782-4VG7
Vulnerability from github – Published: 2024-08-12 15:30 – Updated: 2024-08-13 03:31An Unauthenticated Server-Side Request Forgery (SSRF) in demon callback handling in Havoc 2 0.7 allows attackers to send arbitrary network traffic originating from the team server.
{
"affected": [],
"aliases": [
"CVE-2024-41570"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-12T13:38:31Z",
"severity": "CRITICAL"
},
"details": "An Unauthenticated Server-Side Request Forgery (SSRF) in demon callback handling in Havoc 2 0.7 allows attackers to send arbitrary network traffic originating from the team server.",
"id": "GHSA-5mcq-h782-4vg7",
"modified": "2024-08-13T03:31:16Z",
"published": "2024-08-12T15:30:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41570"
},
{
"type": "WEB",
"url": "https://blog.chebuya.com/posts/server-side-request-forgery-on-havoc-c2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5MF7-M64R-FR3H
Vulnerability from github – Published: 2026-07-10 09:31 – Updated: 2026-07-10 09:31The All-in-One Video Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.8.5 via the 'vdl' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. A Subscriber-level attacker can plant an internal or loopback URL in the mp4 post meta of a newly created aiovg_videos post via XML-RPC wp.newPost, then trigger the unauthenticated ?vdl=<post_id> endpoint to force the server to fetch that URL and stream the full response body back to the requester.
{
"affected": [],
"aliases": [
"CVE-2026-12123"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-10T07:16:27Z",
"severity": "MODERATE"
},
"details": "The All-in-One Video Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.8.5 via the \u0027vdl\u0027 parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. A Subscriber-level attacker can plant an internal or loopback URL in the `mp4` post meta of a newly created `aiovg_videos` post via XML-RPC `wp.newPost`, then trigger the unauthenticated `?vdl=\u003cpost_id\u003e` endpoint to force the server to fetch that URL and stream the full response body back to the requester.",
"id": "GHSA-5mf7-m64r-fr3h",
"modified": "2026-07-10T09:31:36Z",
"published": "2026-07-10T09:31:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12123"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/all-in-one-video-gallery/tags/4.7.5/includes/roles.php#L70"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/all-in-one-video-gallery/tags/4.7.5/public/video.php#L681"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/all-in-one-video-gallery/tags/4.7.5/public/video.php#L724"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/all-in-one-video-gallery/tags/4.7.5/public/video.php#L758"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/all-in-one-video-gallery/tags/4.7.5/public/video.php#L904"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/all-in-one-video-gallery/tags/4.8.5/includes/roles.php#L70"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/all-in-one-video-gallery/tags/4.8.5/public/video.php#L681"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/all-in-one-video-gallery/tags/4.8.5/public/video.php#L724"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/all-in-one-video-gallery/tags/4.8.5/public/video.php#L758"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/all-in-one-video-gallery/tags/4.8.5/public/video.php#L904"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3582575"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a3bb454c-ac0e-4915-8c6e-070596f7595a?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-5MH3-RHM7-JXX3
Vulnerability from github – Published: 2025-03-20 12:32 – Updated: 2025-03-20 12:32A Server-Side Request Forgery (SSRF) vulnerability exists in binary-husky/gpt_academic version git 310122f. The application has a functionality to download papers from arxiv.org, but the URL validation is incomplete. An attacker can exploit this vulnerability to make the application access any URL, including internal services, and read the response. This can be used to access data that are only accessible from the server, such as AWS metadata credentials, and can escalate local exploits to network-based attacks.
{
"affected": [],
"aliases": [
"CVE-2024-12392"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-20T10:15:28Z",
"severity": "MODERATE"
},
"details": "A Server-Side Request Forgery (SSRF) vulnerability exists in binary-husky/gpt_academic version git 310122f. The application has a functionality to download papers from arxiv.org, but the URL validation is incomplete. An attacker can exploit this vulnerability to make the application access any URL, including internal services, and read the response. This can be used to access data that are only accessible from the server, such as AWS metadata credentials, and can escalate local exploits to network-based attacks.",
"id": "GHSA-5mh3-rhm7-jxx3",
"modified": "2025-03-20T12:32:43Z",
"published": "2025-03-20T12:32:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12392"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/858de346-698e-4a72-a9e9-3dbd6c60ac18"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-5MRJ-23W8-W7HX
Vulnerability from github – Published: 2022-05-24 17:31 – Updated: 2022-05-24 17:31BigBlueButton before 2.2.7 allows remote authenticated users to read local files and conduct SSRF attacks via an uploaded Office document that has a crafted URL in an ODF xlink field.
{
"affected": [],
"aliases": [
"CVE-2020-25820"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-10-21T13:15:00Z",
"severity": "MODERATE"
},
"details": "BigBlueButton before 2.2.7 allows remote authenticated users to read local files and conduct SSRF attacks via an uploaded Office document that has a crafted URL in an ODF xlink field.",
"id": "GHSA-5mrj-23w8-w7hx",
"modified": "2022-05-24T17:31:44Z",
"published": "2022-05-24T17:31:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25820"
},
{
"type": "WEB",
"url": "https://github.com/bigbluebutton/bigbluebutton/commit/71fe1eac1e5bd73a2cd44bd79c001086b250e435"
},
{
"type": "WEB",
"url": "https://github.com/bigbluebutton/bigbluebutton/compare/v2.2.26...v2.2.27"
},
{
"type": "WEB",
"url": "https://www.golem.de/news/big-blue-button-das-grosse-blaue-sicherheitsrisiko-2010-151610.html"
},
{
"type": "WEB",
"url": "https://www.redteam-pentesting.de/advisories/rt-sa-2020-005"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/159667/BigBlueButton-2.2.25-File-Disclosure-Server-Side-Request-Forgery.html"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-5MVJ-M7FW-M49W
Vulnerability from github – Published: 2026-08-11 12:30 – Updated: 2026-09-03 15:32A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy. A namespace tenant can plant a ProjectHelmChartRepository with an arbitrary URL that the console pod fetches server-side, bypassing tenant egress restrictions. Combined with catalog metadata poisoning and admin-mediated chart installation, this enables privilege escalation.
{
"affected": [],
"aliases": [
"CVE-2026-50237"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-11T12:17:38Z",
"severity": "HIGH"
},
"details": "A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy. A namespace tenant can plant a ProjectHelmChartRepository with an arbitrary URL that the console pod fetches server-side, bypassing tenant egress restrictions. Combined with catalog metadata poisoning and admin-mediated chart installation, this enables privilege escalation.",
"id": "GHSA-5mvj-m7fw-m49w",
"modified": "2026-09-03T15:32:01Z",
"published": "2026-08-11T12:30:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50237"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:54188"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:54206"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:54545"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:54555"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:54583"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:54602"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:54770"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:56789"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:56854"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:56912"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:60023"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-50237"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484746"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-5MX2-758C-CG2X
Vulnerability from github – Published: 2026-08-05 15:32 – Updated: 2026-08-05 15:32go-shiori's DownloadBookmark() (internal/core/download.go) fetches a caller-supplied bookmark URL using a plain http.Client with no custom DialContext or destination-IP validation (no IsLoopback(), IsPrivate(), IsUnspecified(), or IsLinkLocalUnicast() checks). An authenticated user creating or updating a bookmark via POST /api/bookmark, PUT /api/v1/bookmarks/cache, or POST /api/bookmarks/ext can supply a loopback (127.0.0.1) or 0.0.0.0 (which Linux redirects to loopback) URL, causing the server to make outbound requests to internal-only services, cloud metadata endpoints, or other network-restricted resources.
{
"affected": [],
"aliases": [
"CVE-2026-71280"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-05T13:24:52Z",
"severity": "HIGH"
},
"details": "go-shiori\u0027s DownloadBookmark() (internal/core/download.go) fetches a caller-supplied bookmark URL using a plain http.Client with no custom DialContext or destination-IP validation (no IsLoopback(), IsPrivate(), IsUnspecified(), or IsLinkLocalUnicast() checks). An authenticated user creating or updating a bookmark via POST /api/bookmark, PUT /api/v1/bookmarks/cache, or POST /api/bookmarks/ext can supply a loopback (127.0.0.1) or 0.0.0.0 (which Linux redirects to loopback) URL, causing the server to make outbound requests to internal-only services, cloud metadata endpoints, or other network-restricted resources.",
"id": "GHSA-5mx2-758c-cg2x",
"modified": "2026-08-05T15:32:20Z",
"published": "2026-08-05T15:32:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-71280"
},
{
"type": "WEB",
"url": "https://github.com/go-shiori/shiori"
},
{
"type": "WEB",
"url": "https://github.com/go-shiori/shiori/blob/master/internal/core/download.go"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-5P37-9Q3Q-VH68
Vulnerability from github – Published: 2024-05-14 18:31 – Updated: 2024-07-03 18:41An issue was discovered in linqi before 1.4.0.1 on Windows. There is SSRF via Document template generation; i.e., via remote images in process creation, file inclusion, and PDF document generation via malicious JavaScript.
{
"affected": [],
"aliases": [
"CVE-2024-33864"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-14T16:17:22Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in linqi before 1.4.0.1 on Windows. There is SSRF via Document template generation; i.e., via remote images in process creation, file inclusion, and PDF document generation via malicious JavaScript.",
"id": "GHSA-5p37-9q3q-vh68",
"modified": "2024-07-03T18:41:31Z",
"published": "2024-05-14T18:31:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33864"
},
{
"type": "WEB",
"url": "https://linqi.help/Updates/en#/SecurityUpdates"
},
{
"type": "WEB",
"url": "https://www.linqi.de/de-DE/blog.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-5P3M-VHH6-9236
Vulnerability from github – Published: 2026-08-20 18:30 – Updated: 2026-08-20 18:30Summary
Stigmem allows an authenticated user to create a webhook subscription with a user-controlled delivery_address. That value is stored and later used directly by the subscription delivery worker as the destination of a server-side HTTP POST request.
The codebase already contains an outbound SSRF guard, assert_safe_url(), which blocks loopback, private, link-local, and metadata-style destinations. However, the subscription webhook delivery path does not appear to apply this guard either when the subscription is created or immediately before delivery.
As a result, an authenticated user can configure a webhook destination such as http://127.0.0.1:9999/ssrf, trigger a matching fact-change event, and cause the Stigmem server to issue a server-side HTTP request to an internal loopback address.
Details
Relevant files:
```text node/src/stigmem_node/routes/subscriptions.py node/src/stigmem_node/subscription_delivery.py node/src/stigmem_node/models/subscriptions.py node/src/stigmem_node/utility/net_util.py
SubscriptionCreateRequest accepts delivery_address as a plain string and validates only that it has a minimum length:
class SubscriptionCreateRequest(BaseModel): target: str = Field(..., min_length=1) on_change: str = Field(...) delivery_address: str = Field(..., min_length=1)
The create route persists this value directly:
conn.execute( """INSERT INTO subscriptions (id, subscriber_identity, target, target_kind, on_change, delivery_address, idempotency_key, created_at, tenant_id) VALUES (?,?,?,?,?,?,?,?,?)""", ( sub_id, identity.entity_uri, req.target, target_kind, req.on_change, req.delivery_address, req.idempotency_key, now, identity.tenant_id, ), )
The delivery worker later sends a server-side request to the stored value:
with httpx.Client(timeout=10.0) as client: resp = client.post( event["delivery_address"], json=body, headers={ "Content-Type": "application/json", "X-Stigmem-Event-Id": event["id"], }, )
The codebase already has an SSRF guard in node/src/stigmem_node/utility/net_util.py:
def assert_safe_url( url: str, *, allow_schemes: frozenset[str] = frozenset({"https"}), ) -> None:
This guard blocks private, loopback, link-local, and metadata-style ranges, including 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, and 169.254.0.0/16.
However, I did not observe assert_safe_url() being called for subscription delivery_address during subscription creation or before webhook delivery.
PoC
Tested against stigmem-node 0.9.0a10.
Start an internal listener on the same host: const http = require("http");
http.createServer((req, res) => { console.log("HIT:", req.method, req.url); console.log("HEADERS:", req.headers);
let body = ""; req.on("data", chunk => body += chunk); req.on("end", () => { console.log("BODY:", body); res.writeHead(200, { "Content-Type": "application/json" }); res.end(JSON.stringify({ ok: true, internal: true })); }); }).listen(9999, "127.0.0.1", () => { console.log("Listening on http://127.0.0.1:9999"); }); Start Stigmem locally: cd node pip install -e . export STIGMEM_DB_PATH="$(pwd)/ssrf-test.db" export STIGMEM_AUTH_REQUIRED=true export STIGMEM_HOST=127.0.0.1 export STIGMEM_PORT=8765 export STIGMEM_SUBSCRIPTION_DELIVERY_SWEEP_S=1 export KEY=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa stigmem auth bootstrap-key --key "$KEY" stigmem-node Confirm the service is running: curl -i http://127.0.0.1:8765/healthz
Response:
HTTP/1.1 200 OK {"status":"ok"} Create a webhook subscription whose delivery_address points to loopback: curl -i -X POST "http://127.0.0.1:8765/v1/subscriptions" \ -H "Authorization: Bearer $KEY" \ -H "Content-Type: application/json" \ -d '{ "target": "local", "on_change": "webhook", "delivery_address": "http://127.0.0.1:9999/ssrf", "idempotency_key": "ssrf-test-1" }'
Observed response:
HTTP/1.1 201 Created
The response confirmed that the loopback webhook destination was accepted and stored:
{ "on_change": "webhook", "delivery_address": "http://127.0.0.1:9999/ssrf", "circuit_open": false, "consecutive_failures": 0 } Trigger a matching fact-change event: curl -i -X POST "http://127.0.0.1:8765/v1/facts" \ -H "Authorization: Bearer $KEY" \ -H "Content-Type: application/json" \ -d '{ "entity": "stigmem://test/entity/ssrf", "relation": "test:relation", "value": { "type": "text", "v": "trigger webhook ssrf" }, "source": "stigmem://test/source/researcher", "scope": "local" }' The internal listener receives a server-side request from Stigmem: HIT: POST /ssrf HEADERS: { host: '127.0.0.1:9999', accept: '/', 'accept-encoding': 'gzip, deflate', connection: 'keep-alive', 'user-agent': 'python-httpx/0.28.1', 'content-type': 'application/json', 'x-stigmem-event-id': '', 'content-length': '506' }
The body contained the Stigmem event payload, including the subscription id, entity, relation, value, source, timestamp, and scope.
This confirms that an authenticated user-controlled subscription webhook destination can cause the Stigmem backend to connect to an internal loopback service.
Impact
This creates a blind SSRF primitive from the Stigmem server.
An authenticated user can cause the Stigmem backend to make HTTP POST requests to internal destinations reachable from the server, including loopback services, private network services, and link-local metadata-style endpoints if reachable in the deployment environment.
Potential impact includes:
- Internal service probing through webhook delivery success/failure behavior
- Requests to localhost-only admin services
- Requests to private RFC1918 network services
- Requests to cloud metadata/link-local endpoints where reachable
- Persistent SSRF because the malicious webhook destination is stored and retried
Even if the HTTP response body is not returned to the attacker, delivery status, retry behavior, circuit-breaker behavior, and logs may provide an internal reachability oracle.
Suggested remediation
Apply destination validation at both subscription creation time and delivery time.
Recommended changes:
- For
on_change="webhook", validatedelivery_addresswithassert_safe_url(). - Prefer
https://only by default. - If
http://is needed for local development, require an explicit operator-controlled allowlist. - Re-validate immediately before delivery to reduce stale validation and DNS rebinding risk.
- Disable redirects or validate every redirect target before following.
- Add regression tests proving that localhost, 127.0.0.1, private RFC1918 ranges, and 169.254.169.254 are rejected as webhook destinations.
Example patch pattern:
from stigmem_node.utility.net_util import assert_safe_url
if req.on_change == "webhook": try: assert_safe_url(req.delivery_address, allow_schemes=frozenset({"https"})) except ValueError as exc: raise HTTPException(status_code=400, detail=f"unsafe webhook URL: {exc}") from exc
And before delivery:
try: assert_safe_url(event["delivery_address"], allow_schemes=frozenset({"https"})) except ValueError: mark_delivery_failed(...) return
Before clicking submit, attach screenshot or paste the listener proof in the PoC section. This is the key evidence:
```text HIT: POST /ssrf user-agent: python-httpx/0.28.1 x-stigmem-event-id: ...
Kindly check this out: Eidetic_CVE_Report.pdf
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "stigmem-node"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.9.0a11"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-20",
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-08-20T18:30:50Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Summary\n\nStigmem allows an authenticated user to create a webhook subscription with a user-controlled `delivery_address`. That value is stored and later used directly by the subscription delivery worker as the destination of a server-side HTTP POST request.\n\nThe codebase already contains an outbound SSRF guard, `assert_safe_url()`, which blocks loopback, private, link-local, and metadata-style destinations. However, the subscription webhook delivery path does not appear to apply this guard either when the subscription is created or immediately before delivery.\n\nAs a result, an authenticated user can configure a webhook destination such as `http://127.0.0.1:9999/ssrf`, trigger a matching fact-change event, and cause the Stigmem server to issue a server-side HTTP request to an internal loopback address.\n\n### Details\n\nRelevant files:\n\n```text\nnode/src/stigmem_node/routes/subscriptions.py\nnode/src/stigmem_node/subscription_delivery.py\nnode/src/stigmem_node/models/subscriptions.py\nnode/src/stigmem_node/utility/net_util.py\n\nSubscriptionCreateRequest accepts delivery_address as a plain string and validates only that it has a minimum length:\n\nclass SubscriptionCreateRequest(BaseModel):\n target: str = Field(..., min_length=1)\n on_change: str = Field(...)\n delivery_address: str = Field(..., min_length=1)\n\nThe create route persists this value directly:\n\nconn.execute(\n \"\"\"INSERT INTO subscriptions\n (id, subscriber_identity, target, target_kind, on_change,\n delivery_address, idempotency_key, created_at, tenant_id)\n VALUES (?,?,?,?,?,?,?,?,?)\"\"\",\n (\n sub_id,\n identity.entity_uri,\n req.target,\n target_kind,\n req.on_change,\n req.delivery_address,\n req.idempotency_key,\n now,\n identity.tenant_id,\n ),\n)\n\nThe delivery worker later sends a server-side request to the stored value:\n\nwith httpx.Client(timeout=10.0) as client:\n resp = client.post(\n event[\"delivery_address\"],\n json=body,\n headers={\n \"Content-Type\": \"application/json\",\n \"X-Stigmem-Event-Id\": event[\"id\"],\n },\n )\n\nThe codebase already has an SSRF guard in node/src/stigmem_node/utility/net_util.py:\n\ndef assert_safe_url(\n url: str,\n *,\n allow_schemes: frozenset[str] = frozenset({\"https\"}),\n) -\u003e None:\n\nThis guard blocks private, loopback, link-local, and metadata-style ranges, including 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, and 169.254.0.0/16.\n\nHowever, I did not observe assert_safe_url() being called for subscription delivery_address during subscription creation or before webhook delivery.\n\nPoC\n\nTested against stigmem-node 0.9.0a10.\n\nStart an internal listener on the same host:\nconst http = require(\"http\");\n\nhttp.createServer((req, res) =\u003e {\n console.log(\"HIT:\", req.method, req.url);\n console.log(\"HEADERS:\", req.headers);\n\n let body = \"\";\n req.on(\"data\", chunk =\u003e body += chunk);\n req.on(\"end\", () =\u003e {\n console.log(\"BODY:\", body);\n res.writeHead(200, { \"Content-Type\": \"application/json\" });\n res.end(JSON.stringify({ ok: true, internal: true }));\n });\n}).listen(9999, \"127.0.0.1\", () =\u003e {\n console.log(\"Listening on http://127.0.0.1:9999\");\n});\nStart Stigmem locally:\ncd node\npip install -e .\nexport STIGMEM_DB_PATH=\"$(pwd)/ssrf-test.db\"\nexport STIGMEM_AUTH_REQUIRED=true\nexport STIGMEM_HOST=127.0.0.1\nexport STIGMEM_PORT=8765\nexport STIGMEM_SUBSCRIPTION_DELIVERY_SWEEP_S=1\nexport KEY=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\nstigmem auth bootstrap-key --key \"$KEY\"\nstigmem-node\nConfirm the service is running:\ncurl -i http://127.0.0.1:8765/healthz\n\nResponse:\n\nHTTP/1.1 200 OK\n{\"status\":\"ok\"}\nCreate a webhook subscription whose delivery_address points to loopback:\ncurl -i -X POST \"http://127.0.0.1:8765/v1/subscriptions\" \\\n -H \"Authorization: Bearer $KEY\" \\\n -H \"Content-Type: application/json\" \\\n -d \u0027{\n \"target\": \"local\",\n \"on_change\": \"webhook\",\n \"delivery_address\": \"http://127.0.0.1:9999/ssrf\",\n \"idempotency_key\": \"ssrf-test-1\"\n }\u0027\n\nObserved response:\n\nHTTP/1.1 201 Created\n\nThe response confirmed that the loopback webhook destination was accepted and stored:\n\n{\n \"on_change\": \"webhook\",\n \"delivery_address\": \"http://127.0.0.1:9999/ssrf\",\n \"circuit_open\": false,\n \"consecutive_failures\": 0\n}\nTrigger a matching fact-change event:\ncurl -i -X POST \"http://127.0.0.1:8765/v1/facts\" \\\n -H \"Authorization: Bearer $KEY\" \\\n -H \"Content-Type: application/json\" \\\n -d \u0027{\n \"entity\": \"stigmem://test/entity/ssrf\",\n \"relation\": \"test:relation\",\n \"value\": { \"type\": \"text\", \"v\": \"trigger webhook ssrf\" },\n \"source\": \"stigmem://test/source/researcher\",\n \"scope\": \"local\"\n }\u0027\nThe internal listener receives a server-side request from Stigmem:\nHIT: POST /ssrf\nHEADERS: {\n host: \u0027127.0.0.1:9999\u0027,\n accept: \u0027*/*\u0027,\n \u0027accept-encoding\u0027: \u0027gzip, deflate\u0027,\n connection: \u0027keep-alive\u0027,\n \u0027user-agent\u0027: \u0027python-httpx/0.28.1\u0027,\n \u0027content-type\u0027: \u0027application/json\u0027,\n \u0027x-stigmem-event-id\u0027: \u0027\u003cevent-id\u003e\u0027,\n \u0027content-length\u0027: \u0027506\u0027\n}\n\nThe body contained the Stigmem event payload, including the subscription id, entity, relation, value, source, timestamp, and scope.\n\nThis confirms that an authenticated user-controlled subscription webhook destination can cause the Stigmem backend to connect to an internal loopback service.\n\nImpact\n\nThis creates a blind SSRF primitive from the Stigmem server.\n\nAn authenticated user can cause the Stigmem backend to make HTTP POST requests to internal destinations reachable from the server, including loopback services, private network services, and link-local metadata-style endpoints if reachable in the deployment environment.\n\nPotential impact includes:\n\n- Internal service probing through webhook delivery success/failure behavior\n- Requests to localhost-only admin services\n- Requests to private RFC1918 network services\n- Requests to cloud metadata/link-local endpoints where reachable\n- Persistent SSRF because the malicious webhook destination is stored and retried\n\nEven if the HTTP response body is not returned to the attacker, delivery status, retry behavior, circuit-breaker behavior, and logs may provide an internal reachability oracle.\n\nSuggested remediation\n\nApply destination validation at both subscription creation time and delivery time.\n\nRecommended changes:\n\n1. For `on_change=\"webhook\"`, validate `delivery_address` with `assert_safe_url()`.\n2. Prefer `https://` only by default.\n3. If `http://` is needed for local development, require an explicit operator-controlled allowlist.\n4. Re-validate immediately before delivery to reduce stale validation and DNS rebinding risk.\n5. Disable redirects or validate every redirect target before following.\n6. Add regression tests proving that localhost, 127.0.0.1, private RFC1918 ranges, and 169.254.169.254 are rejected as webhook destinations.\n\nExample patch pattern:\n\nfrom stigmem_node.utility.net_util import assert_safe_url\n\nif req.on_change == \"webhook\":\n try:\n assert_safe_url(req.delivery_address, allow_schemes=frozenset({\"https\"}))\n except ValueError as exc:\n raise HTTPException(status_code=400, detail=f\"unsafe webhook URL: {exc}\") from exc\n\nAnd before delivery:\n\ntry:\n assert_safe_url(event[\"delivery_address\"], allow_schemes=frozenset({\"https\"}))\nexcept ValueError:\n mark_delivery_failed(...)\n return\n\nBefore clicking submit, attach screenshot or paste the listener proof in the PoC section. This is the key evidence:\n\n```text\nHIT: POST /ssrf\nuser-agent: python-httpx/0.28.1\nx-stigmem-event-id: ...\n\nKindly check this out:\n[Eidetic_CVE_Report.pdf](https://github.com/user-attachments/files/28415009/Eidetic_CVE_Report.pdf)",
"id": "GHSA-5p3m-vhh6-9236",
"modified": "2026-08-20T18:30:51Z",
"published": "2026-08-20T18:30:50Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/eidetic-labs/stigmem/security/advisories/GHSA-5p3m-vhh6-9236"
},
{
"type": "WEB",
"url": "https://github.com/eidetic-labs/stigmem/pull/726"
},
{
"type": "WEB",
"url": "https://github.com/eidetic-labs/stigmem/commit/11637401d50629fef040382aee5af4571842c152"
},
{
"type": "WEB",
"url": "https://github.com/eidetic-labs/stigmem/commit/2ff5be29291d1c042e00d57c5f9ef93650cc90e0"
},
{
"type": "PACKAGE",
"url": "https://github.com/eidetic-labs/stigmem"
},
{
"type": "WEB",
"url": "https://github.com/eidetic-labs/stigmem/releases/tag/v0.9.0a11"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "stigmem-node has blind SSRF via unvalidated webhook subscription delivery_address"
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.