CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
6271 vulnerabilities reference this CWE, most recent first.
GHSA-F7H5-C625-3795
Vulnerability from github – Published: 2025-07-16 12:30 – Updated: 2025-07-18 17:45In Eclipse GlassFish version 6.2.5, it is possible to perform a Server Side Request Forgery attack using specific endpoints.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.glassfish.main.admingui:console-common"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "6.2.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-9408"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2025-07-18T17:45:26Z",
"nvd_published_at": "2025-07-16T12:15:23Z",
"severity": "HIGH"
},
"details": "In Eclipse GlassFish version 6.2.5, it is possible to perform a Server Side Request Forgery attack using specific endpoints.",
"id": "GHSA-f7h5-c625-3795",
"modified": "2025-07-18T17:45:26Z",
"published": "2025-07-16T12:30:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9408"
},
{
"type": "PACKAGE",
"url": "https://github.com/eclipse-ee4j/glassfish"
},
{
"type": "WEB",
"url": "https://gitlab.eclipse.org/security/cve-assignement/-/issues/38"
},
{
"type": "WEB",
"url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/239"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Eclipse GlassFish is vulnerable to Server Side Request Forgery attacks through specific endpoints"
}
GHSA-F7QG-XJ45-W956
Vulnerability from github – Published: 2025-09-15 20:31 – Updated: 2025-09-22 15:49Impact
A vulnerability in Ghost's oEmbed mechanism allows staff users to exfiltrate data from internal systems via SSRF.
Vulnerable versions
This vulnerability is present in Ghost v5.99.0 to v5.130.3 to and Ghost v6.0.0 to v6.0.8.
Patches
v5.130.4 and v6.0.9 contain a fix for this issue.
References
The original report is available here: https://fluidattacks.com/advisories/regida
We thank Cristian Vargas for discovering and disclosing this vulnerability responsibly.
For more information
If you have any questions or comments about this advisory, email us at security@ghost.org.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 6.0.8"
},
"package": {
"ecosystem": "npm",
"name": "ghost"
},
"ranges": [
{
"events": [
{
"introduced": "6.0.0"
},
{
"fixed": "6.0.9"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 5.130.3"
},
"package": {
"ecosystem": "npm",
"name": "ghost"
},
"ranges": [
{
"events": [
{
"introduced": "5.99.0"
},
{
"fixed": "5.130.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-9862"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2025-09-15T20:31:14Z",
"nvd_published_at": "2025-09-17T15:15:43Z",
"severity": "MODERATE"
},
"details": "### Impact\n\nA vulnerability in Ghost\u0027s oEmbed mechanism allows staff users to exfiltrate data from internal systems via SSRF.\n\n### Vulnerable versions\n\nThis vulnerability is present in Ghost v5.99.0 to v5.130.3 to and Ghost v6.0.0 to v6.0.8.\n\n### Patches\n\nv5.130.4 and v6.0.9 contain a fix for this issue.\n\n### References\n\nThe original report is available here: https://fluidattacks.com/advisories/regida\n\nWe thank Cristian Vargas for discovering and disclosing this vulnerability responsibly. \n\n### For more information\n\nIf you have any questions or comments about this advisory, email us at [security@ghost.org](mailto:security@ghost.org).",
"id": "GHSA-f7qg-xj45-w956",
"modified": "2025-09-22T15:49:29Z",
"published": "2025-09-15T20:31:14Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/TryGhost/Ghost/security/advisories/GHSA-f7qg-xj45-w956"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9862"
},
{
"type": "WEB",
"url": "https://github.com/TryGhost/Ghost/commit/01d64c7c0ffbf90cd036195c60ded6d08077d612"
},
{
"type": "WEB",
"url": "https://github.com/TryGhost/Ghost/commit/ffe9d079afa68557c581d224f1ff126e625b06e3"
},
{
"type": "WEB",
"url": "https://fluidattacks.com/advisories/regida"
},
{
"type": "PACKAGE",
"url": "https://github.com/TryGhost/Ghost"
},
{
"type": "WEB",
"url": "https://github.com/TryGhost/Ghost/releases/tag/v6.0.9"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Ghost vulnerable to Server Side Request Forgery (SSRF) via oEmbed Bookmark"
}
GHSA-F7RM-PM4C-W834
Vulnerability from github – Published: 2025-08-15 18:31 – Updated: 2025-08-15 18:31Server-Side Request Forgery (SSRF) vulnerability in Drupal AI SEO Link Advisor allows Server Side Request Forgery.This issue affects AI SEO Link Advisor: from 0.0.0 before 1.0.6.
{
"affected": [],
"aliases": [
"CVE-2025-8675"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-15T17:15:33Z",
"severity": "MODERATE"
},
"details": "Server-Side Request Forgery (SSRF) vulnerability in Drupal AI SEO Link Advisor allows Server Side Request Forgery.This issue affects AI SEO Link Advisor: from 0.0.0 before 1.0.6.",
"id": "GHSA-f7rm-pm4c-w834",
"modified": "2025-08-15T18:31:12Z",
"published": "2025-08-15T18:31:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8675"
},
{
"type": "WEB",
"url": "https://www.drupal.org/sa-contrib-2025-095"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-F7V3-XHM6-W245
Vulnerability from github – Published: 2026-10-07 16:22 – Updated: 2026-10-07 16:22Impact
An authenticated user who can register or modify documentation sources may cause a TechDocs build to access resources outside the intended documentation boundary. Depending on deployment configuration, this may expose sensitive backend-host data or internal network resources.
Patches
Patched in @backstage/plugin-techdocs-node version 1.15.4.
Adopters must also use pymdown-extensions version 10.21.3 or newer, normally through mkdocs-techdocs-core version 1.7.0 or newer. @backstage/plugin-techdocs-node does not control the Python dependencies used by the generator; with an older PyMdown release, snippets may remain vulnerable to file inclusion even after their configuration is sanitized.
Workarounds
- Generate TechDocs only from trusted repositories with reviewed MkDocs configuration.
- Use isolated build environments with restricted filesystem access and network egress.
- Prefer externally generated TechDocs with appropriately sandboxed CI.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@backstage/plugin-techdocs-node"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.15.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-106557"
],
"database_specific": {
"cwe_ids": [
"CWE-22",
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-07T16:22:58Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Impact\n\nAn authenticated user who can register or modify documentation sources may cause a TechDocs build to access resources outside the intended documentation boundary. Depending on deployment configuration, this may expose sensitive backend-host data or internal network resources.\n\n### Patches\n\nPatched in `@backstage/plugin-techdocs-node` version `1.15.4`.\n\nAdopters must also use `pymdown-extensions` version `10.21.3` or newer, normally through `mkdocs-techdocs-core` version `1.7.0` or newer. `@backstage/plugin-techdocs-node` does not control the Python dependencies used by the generator; with an older PyMdown release, snippets may remain vulnerable to file inclusion even after their configuration is sanitized.\n\n### Workarounds\n\n- Generate TechDocs only from trusted repositories with reviewed MkDocs configuration.\n- Use isolated build environments with restricted filesystem access and network egress.\n- Prefer externally generated TechDocs with appropriately sandboxed CI.",
"id": "GHSA-f7v3-xhm6-w245",
"modified": "2026-10-07T16:22:58Z",
"published": "2026-10-07T16:22:58Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/backstage/backstage/security/advisories/GHSA-f7v3-xhm6-w245"
},
{
"type": "WEB",
"url": "https://github.com/backstage/backstage/commit/017ace52d9b327ededc6704cf17799c875ae0f29"
},
{
"type": "WEB",
"url": "https://github.com/backstage/backstage/commit/2d9de4ca117a529de4b6ed7dfb7aa507ca7b3f91"
},
{
"type": "PACKAGE",
"url": "https://github.com/backstage/backstage"
},
{
"type": "WEB",
"url": "https://github.com/backstage/backstage/releases/tag/v1.50.5"
},
{
"type": "WEB",
"url": "https://github.com/backstage/backstage/releases/tag/v1.54.6"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Backstage has improper input validation in TechDocs Markdown extension configuration"
}
GHSA-F8G7-2GFJ-4V34
Vulnerability from github – Published: 2026-09-08 18:32 – Updated: 2026-09-08 18:32Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network.
{
"affected": [],
"aliases": [
"CVE-2026-69361"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-08T18:18:55Z",
"severity": "MODERATE"
},
"details": "Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network.",
"id": "GHSA-f8g7-2gfj-4v34",
"modified": "2026-09-08T18:32:26Z",
"published": "2026-09-08T18:32:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69361"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69361"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-F8G8-8F29-J2HW
Vulnerability from github – Published: 2026-09-14 21:31 – Updated: 2026-09-14 21:31A security flaw has been discovered in netease-youdao LobsterAI 2026.6.15/2026.8.28/2026.9.3/2026.9.4. Impacted is the function OpenClawConfigSync.buildBrowserConfig of the file src/main/libs/openclawConfigSync.ts of the component Browser Network Configuration. The manipulation results in server-side request forgery. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The reported GitHub issue was closed automatically due to inactivity.
{
"affected": [],
"aliases": [
"CVE-2026-90818"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-14T21:17:41Z",
"severity": "LOW"
},
"details": "A security flaw has been discovered in netease-youdao LobsterAI 2026.6.15/2026.8.28/2026.9.3/2026.9.4. Impacted is the function OpenClawConfigSync.buildBrowserConfig of the file src/main/libs/openclawConfigSync.ts of the component Browser Network Configuration. The manipulation results in server-side request forgery. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The reported GitHub issue was closed automatically due to inactivity.",
"id": "GHSA-f8g8-8f29-j2hw",
"modified": "2026-09-14T21:31:56Z",
"published": "2026-09-14T21:31:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90818"
},
{
"type": "WEB",
"url": "https://github.com/netease-youdao/LobsterAI/issues/2181"
},
{
"type": "WEB",
"url": "https://gist.github.com/YLChen-007/e5f88777e7c50549fd98b23b2988f78d"
},
{
"type": "WEB",
"url": "https://github.com/netease-youdao/LobsterAI"
},
{
"type": "WEB",
"url": "https://vuldb.com/cve/CVE-2026-90818"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/922881"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/403321"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/403321/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-F8HV-G549-HWG2
Vulnerability from github – Published: 2026-04-16 20:45 – Updated: 2026-06-08 19:54Impact
The webhook add-on did not utilize existing SSRF protection.
Patches
- https://github.com/WeblateOrg/weblate/pull/18815
Workarounds
Disabling the add-on would avoid misusing this.
References
Thanks to @Lihfdgjr for reporting this via GitHub.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "Weblate"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.17"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-39845"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-16T20:45:04Z",
"nvd_published_at": "2026-04-15T19:16:36Z",
"severity": "MODERATE"
},
"details": "### Impact\nThe webhook add-on did not utilize existing SSRF protection.\n\n### Patches\n* https://github.com/WeblateOrg/weblate/pull/18815\n\n### Workarounds\nDisabling the add-on would avoid misusing this.\n\n### References\nThanks to @Lihfdgjr for reporting this via GitHub.",
"id": "GHSA-f8hv-g549-hwg2",
"modified": "2026-06-08T19:54:41Z",
"published": "2026-04-16T20:45:04Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/WeblateOrg/weblate/security/advisories/GHSA-f8hv-g549-hwg2"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39845"
},
{
"type": "WEB",
"url": "https://github.com/WeblateOrg/weblate/pull/18815"
},
{
"type": "PACKAGE",
"url": "https://github.com/WeblateOrg/weblate"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/weblate/PYSEC-2026-156.yaml"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Weblate: SSRF via the webhook add-on using unprotected fetch_url()"
}
GHSA-F8JX-JHWH-GQ9J
Vulnerability from github – Published: 2022-05-24 16:57 – Updated: 2024-04-04 02:02A blind SSRF vulnerability exists in the Visualizer plugin before 3.3.1 for WordPress via wp-json/visualizer/v1/upload-data.
{
"affected": [],
"aliases": [
"CVE-2019-16932"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-09-30T16:15:00Z",
"severity": "CRITICAL"
},
"details": "A blind SSRF vulnerability exists in the Visualizer plugin before 3.3.1 for WordPress via wp-json/visualizer/v1/upload-data.",
"id": "GHSA-f8jx-jhwh-gq9j",
"modified": "2024-04-04T02:02:11Z",
"published": "2022-05-24T16:57:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16932"
},
{
"type": "WEB",
"url": "https://nathandavison.com/blog/wordpress-visualizer-plugin-xss-and-ssrf"
},
{
"type": "WEB",
"url": "https://wordpress.org/plugins/visualizer/#developers"
},
{
"type": "WEB",
"url": "https://wpvulndb.com/vulnerabilities/9892"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-F8R7-7HV9-7F43
Vulnerability from github – Published: 2022-05-14 03:13 – Updated: 2022-12-12 16:34A server-side request forgery vulnerability exists in Jenkins CAS Plugin 1.4.1 and older in CasSecurityRealm.java that allows attackers with Overall/Read access to cause Jenkins to send a GET request to a specified URL. Additionally, this form validation method did not require POST requests, resulting in a CSRF vulnerability. As of version 1.4.2, this form validation method requires POST requests and the Overall/Administer permission.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.4.1"
},
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:cas-plugin"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.4.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2018-1000188"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2022-12-12T16:34:18Z",
"nvd_published_at": "2018-06-05T20:29:00Z",
"severity": "MODERATE"
},
"details": "A server-side request forgery vulnerability exists in Jenkins CAS Plugin 1.4.1 and older in CasSecurityRealm.java that allows attackers with Overall/Read access to cause Jenkins to send a GET request to a specified URL. Additionally, this form validation method did not require POST requests, resulting in a CSRF vulnerability. As of version 1.4.2, this form validation method requires POST requests and the Overall/Administer permission.",
"id": "GHSA-f8r7-7hv9-7f43",
"modified": "2022-12-12T16:34:18Z",
"published": "2022-05-14T03:13:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000188"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/cas-plugin/commit/25d952151d61dec3627e875f03ac4f648d5e883d"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/cas-plugin"
},
{
"type": "WEB",
"url": "https://jenkins.io/security/advisory/2018-06-04/#SECURITY-809"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Jenkins CAS Plugin Server-Side Request Forgery vulnerability"
}
GHSA-F8VW-8VGH-22R9
Vulnerability from github – Published: 2025-07-18 15:31 – Updated: 2025-09-13 04:43A vulnerability, which was classified as critical, was found in Xuxueli xxl-job up to 3.1.1. Affected is the function httpJobHandler of the file src\main\java\com\xxl\job\executor\service\jobhandler\SampleXxlJob.java. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.xuxueli:xxl-job-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "3.1.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-7787"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2025-07-21T12:26:33Z",
"nvd_published_at": "2025-07-18T15:15:31Z",
"severity": "LOW"
},
"details": "A vulnerability, which was classified as critical, was found in Xuxueli xxl-job up to 3.1.1. Affected is the function httpJobHandler of the file src\\main\\java\\com\\xxl\\job\\executor\\service\\jobhandler\\SampleXxlJob.java. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.",
"id": "GHSA-f8vw-8vgh-22r9",
"modified": "2025-09-13T04:43:42Z",
"published": "2025-07-18T15:31:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-7787"
},
{
"type": "WEB",
"url": "https://github.com/xuxueli/xxl-job/issues/3749"
},
{
"type": "PACKAGE",
"url": "https://github.com/xuxueli/xxl-job"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.316848"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.316848"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.615741"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"type": "CVSS_V4"
}
],
"summary": "XXL-JOB is vulnerable to SSRF attacks"
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.