CWE-918 服务端请求伪造(SSRF) 类弱点 2359 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-918 服务端请求伪造（SSRF）是一种允许攻击者诱导服务器发起恶意请求的漏洞。当服务器接收外部提供的 URL 并据此获取内容时，若未严格校验目标地址，攻击者可构造请求访问内网资源或探测内部服务，从而绕过防火墙限制。开发者应实施严格的白名单机制，限制协议类型，禁用重定向，并对所有输入进行深度验证，确保请求仅能访问预期的合法外部资源，从而有效防御此类攻击。
$url = $_GET['url']; # User-controlled input # Fetch the content of the provided URL $response = file_get_contents($url); echo $response;# Define allowed URLs (or domains) $allowed_urls = [ 'https://example.com/data.json', 'https://api.example.com/info', ]; # Get the user-provided URL $url = $_GET['url'] ?? ''; # Validate against allowed URLs if (!in_array($url, $allowed_urls)) { http_response_code(400); echo "Invalid or unauthorized URL."; exit; } # Fetch content safely $response = @file_get_contents($url); if ($response === false) { http_response_code(500); echo "Failed to fetch content."; exit; } echo htmlspecialchars($response); # Escape output for safety| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2024-27564 | ChatGPT 安全漏洞 — mm1.ltd source code | 5.8 | Medium | 2024-03-05 |
| CVE-2024-2057 | LangChain 代码问题漏洞 — langchain_community | 6.3 | Medium | 2024-03-01 |
| CVE-2024-27949 | WordPress Plugin Sirv 代码问题漏洞 — Sirv | 5.4 | Medium | 2024-03-01 |
| CVE-2024-0403 | Recipes 代码问题漏洞 — Recipes | 6.5 | Medium | 2024-02-29 |
| CVE-2024-1978 | WordPress plugin Friends 安全漏洞 — Friends | 5.5 | Medium | 2024-02-29 |
| CVE-2024-1965 | Haivision Manager和Steamhub 代码问题漏洞 — Aviwest Manager | 6.5 | Medium | 2024-02-28 |
| CVE-2024-1568 | WordPress Plugin Seraphinite Accelerator 安全漏洞 — Seraphinite Accelerator | 6.4 | Medium | 2024-02-28 |
| CVE-2024-0759 | AnythingLLM 代码问题漏洞 — mintplex-labs/anything-llm | 9.3 | - | 2024-02-27 |
| CVE-2024-0440 | AnythingLLM 安全漏洞 — mintplex-labs/anything-llm | 6.5 | - | 2024-02-25 |
| CVE-2024-0455 | AnythingLLM 代码问题漏洞 — mintplex-labs/anything-llm | 8.8 | - | 2024-02-25 |
| CVE-2024-0243 | LangChain 代码问题漏洞 — langchain-ai/langchain | 9.3 | - | 2024-02-24 |
| CVE-2024-1758 | WordPress Plugin SuperFaktura WooCommerce 安全漏洞 — SuperFaktura WooCommerce | 5.4 | Medium | 2024-02-24 |
| CVE-2024-25915 | WordPress Plugin Pexels Free Stock Photos 代码问题漏洞 — Pexels: Free Stock Photos | 4.9 | Medium | 2024-02-23 |
| CVE-2024-23654 | Discourse 安全漏洞 — discourse-ai | 4.1 | Medium | 2024-02-21 |
| CVE-2023-47635 | Decidim 安全漏洞 — decidim | 4.5 | Medium | 2024-02-20 |
| CVE-2024-21498 | Caddy 安全漏洞 — github.com/greenpau/caddy-security | 5.3 | Medium | 2024-02-17 |
| CVE-2023-5122 | Grafana 安全漏洞 — grafana-csv-datasource | 5.0 | Medium | 2024-02-14 |
| CVE-2024-24829 | Mobileiron Sentry 代码问题漏洞 — sentry | 4.3 | Medium | 2024-02-08 |
| CVE-2024-24806 | libuv 代码问题漏洞 — libuv | 7.3 | High | 2024-02-07 |
| CVE-2023-6388 | SuiteCRM 代码问题漏洞 — Suite CRM | 5.0 | Medium | 2024-02-07 |
| CVE-2023-22817 | My Cloud 多款产品代码问题漏洞 — My Cloud OS 5 | 5.5 | Medium | 2024-02-05 |
| CVE-2023-50165 | Pegasystem PEGA Platform 安全漏洞 — Pega Platform | 8.5 | High | 2024-01-31 |
| CVE-2023-47116 | Label Studio 代码问题漏洞 — label-studio | 5.3 | Medium | 2024-01-31 |
| CVE-2023-44313 | Apache ServiceComb Service-Center 代码问题漏洞 — Apache ServiceComb Service-Center | 7.6 | High | 2024-01-31 |
| CVE-2024-23838 | TrueLayer.NET 代码问题漏洞 — truelayer-dotnet | 7.5 | - | 2024-01-30 |
| CVE-2024-23825 | Wordpress plugin TablePress 安全漏洞 — TablePress | 3.0 | Low | 2024-01-30 |
| CVE-2024-1063 | Appwrite 代码问题漏洞 — Appwrite | 5.3 | Medium | 2024-01-30 |
| CVE-2024-1021 | Rebuild 安全漏洞 — Rebuild | 6.3 | Medium | 2024-01-29 |
| CVE-2024-0946 | LyLme Spage 代码问题漏洞 — 60IndexPage | 7.3 | High | 2024-01-26 |
| CVE-2024-0945 | LyLme Spage 代码问题漏洞 — 60IndexPage | 7.3 | High | 2024-01-26 |
CWE-918（服务端请求伪造(SSRF)） 是常见的弱点类别，本平台收录该类弱点关联的 2359 条 CVE 漏洞。