CWE-918 服务端请求伪造(SSRF) 类弱点 1659 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-918 服务端请求伪造（SSRF）是一种允许攻击者诱导服务器发起恶意请求的漏洞。当服务器接收外部提供的 URL 并据此获取内容时，若未严格校验目标地址，攻击者可构造请求访问内网资源或探测内部服务，从而绕过防火墙限制。开发者应实施严格的白名单机制，限制协议类型，禁用重定向，并对所有输入进行深度验证，确保请求仅能访问预期的合法外部资源，从而有效防御此类攻击。
$url = $_GET['url']; # User-controlled input # Fetch the content of the provided URL $response = file_get_contents($url); echo $response;# Define allowed URLs (or domains) $allowed_urls = [ 'https://example.com/data.json', 'https://api.example.com/info', ]; # Get the user-provided URL $url = $_GET['url'] ?? ''; # Validate against allowed URLs if (!in_array($url, $allowed_urls)) { http_response_code(400); echo "Invalid or unauthorized URL."; exit; } # Fetch content safely $response = @file_get_contents($url); if ($response === false) { http_response_code(500); echo "Failed to fetch content."; exit; } echo htmlspecialchars($response); # Escape output for safety| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2022-1191 | livehelperchat 代码问题漏洞 — livehelperchat/livehelperchat | 6.5 | - | 2022-03-31 |
| CVE-2022-24789 | Orckestra C1 CMS 代码问题漏洞 — C1-CMS-Foundation | 7.6 | High | 2022-03-28 |
| CVE-2022-0591 | WordPress plugin FormCraft 代码问题漏洞 — FormCraft | 9.1 | - | 2022-03-21 |
| CVE-2022-0870 | Gogs 代码问题漏洞 — gogs/gogs | 8.2 | - | 2022-03-11 |
| CVE-2022-0766 | Calibre-Web 代码问题漏洞 — janeczku/calibre-web | 9.4 | - | 2022-03-07 |
| CVE-2022-0767 | Calibre-Web 代码问题漏洞 — janeczku/calibre-web | 9.4 | - | 2022-03-07 |
| CVE-2022-0528 | Uppy 代码问题漏洞 — transloadit/uppy | 6.5 | Medium | 2022-03-03 |
| CVE-2022-0768 | AllTube Download 代码问题漏洞 — rudloff/alltube | 7.5 | - | 2022-02-28 |
| CVE-2022-0671 | Red Hat Vscode-Xml 代码问题漏洞 — vscode-xml | 9.1 | - | 2022-02-18 |
| CVE-2022-21215 | Airspan Networks Mmp 代码问题漏洞 — MMP | 10.0 | Critical | 2022-02-18 |
| CVE-2022-23644 | BookWyrm 代码问题漏洞 — bookwyrm | 8.8 | High | 2022-02-16 |
| CVE-2021-25939 | ArangoDB 代码问题漏洞 — arangodb | 2.7 | Low | 2022-02-09 |
| CVE-2022-0508 | PeerTube 代码问题漏洞 — chocobozzz/peertube | 5.3 | - | 2022-02-08 |
| CVE-2022-23206 | Apache Traffic Control 安全漏洞 — Apache Traffic Control | 7.5 | - | 2022-02-06 |
| CVE-2022-0339 | Calibre-Web 代码问题漏洞 — janeczku/calibre-web | 9.1 | - | 2022-01-30 |
| CVE-2022-22993 | Western Digital My Cloud 代码问题漏洞 — My Cloud | 7.8 | High | 2022-01-28 |
| CVE-2022-21697 | Jupyter Server 代码问题漏洞 — jupyter-server-proxy | 6.3 | Medium | 2022-01-25 |
| CVE-2021-36349 | Dell Emc Data Protection Central 代码问题漏洞 — Data Protection Central | 4.3 | Medium | 2022-01-24 |
| CVE-2021-41809 | M-Files Server 代码问题漏洞 — M-Files Server | 3.5 | Low | 2022-01-18 |
| CVE-2022-0132 | PeerTube 代码问题漏洞 — chocobozzz/peertube | 7.5 | - | 2022-01-07 |
| CVE-2021-27738 | Apache Kylin 代码问题漏洞 — Apache Kylin | 7.5 | - | 2022-01-06 |
| CVE-2022-0086 | Uppy 代码问题漏洞 — transloadit/uppy | 9.8 | - | 2022-01-04 |
| CVE-2021-3959 | Bitdefender Endpoint Security Tool 代码问题漏洞 — GravityZone | 6.8 | Medium | 2021-12-16 |
| CVE-2021-37940 | GitHub Enterprise Server 代码问题漏洞 — Enterprisesearch | 4.9 | - | 2021-12-07 |
| CVE-2021-4075 | Snipe-IT 代码问题漏洞 — snipe/snipe-it | 8.1 | - | 2021-12-06 |
| CVE-2021-36327 | Dell EMC Streaming Data Platform 代码问题漏洞 — Dell EMC Streaming Data Platform | 5.3 | Medium | 2021-11-30 |
| CVE-2021-3553 | Bitdefender Endpoint Security Tool 代码问题漏洞 — Endpoint Security Tools | 5.3 | Medium | 2021-11-24 |
| CVE-2021-3552 | Bitdefender Endpoint Security Tool 代码问题漏洞 — Endpoint Security Tools | 5.3 | Medium | 2021-11-24 |
| CVE-2021-43780 | Redash 代码问题漏洞 — redash | 6.8 | Medium | 2021-11-23 |
| CVE-2021-22970 | PortlandLabs Concrete Cms 代码问题漏洞 — https://github.com/concrete5/concrete5 | 9.1 | - | 2021-11-19 |
CWE-918（服务端请求伪造(SSRF)） 是常见的弱点类别，本平台收录该类弱点关联的 1659 条 CVE 漏洞。