CWE-918 服务端请求伪造(SSRF) 类弱点 2359 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-918 服务端请求伪造（SSRF）是一种允许攻击者诱导服务器发起恶意请求的漏洞。当服务器接收外部提供的 URL 并据此获取内容时，若未严格校验目标地址，攻击者可构造请求访问内网资源或探测内部服务，从而绕过防火墙限制。开发者应实施严格的白名单机制，限制协议类型，禁用重定向，并对所有输入进行深度验证，确保请求仅能访问预期的合法外部资源，从而有效防御此类攻击。
$url = $_GET['url']; # User-controlled input # Fetch the content of the provided URL $response = file_get_contents($url); echo $response;# Define allowed URLs (or domains) $allowed_urls = [ 'https://example.com/data.json', 'https://api.example.com/info', ]; # Get the user-provided URL $url = $_GET['url'] ?? ''; # Validate against allowed URLs if (!in_array($url, $allowed_urls)) { http_response_code(400); echo "Invalid or unauthorized URL."; exit; } # Fetch content safely $response = @file_get_contents($url); if ($response === false) { http_response_code(500); echo "Failed to fetch content."; exit; } echo htmlspecialchars($response); # Escape output for safety| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2024-22134 | WordPress plugin Contact Form 7 Extension For Mailchimp 代码问题漏洞 — Contact Form 7 Extension For Mailchimp | 4.9 | Medium | 2024-01-24 |
| CVE-2024-23330 | Tutanota 代码问题漏洞 — tutanota | 5.3 | Medium | 2024-01-23 |
| CVE-2024-22205 | whoogle-search 代码问题漏洞 — whoogle-search | 9.1 | Critical | 2024-01-23 |
| CVE-2024-22203 | whoogle-search 代码问题漏洞 — whoogle-search | 9.1 | Critical | 2024-01-23 |
| CVE-2022-40700 | WordPress plugin Admin CSS MU 代码问题漏洞 — Montonio for WooCommerce | 8.2 | High | 2024-01-19 |
| CVE-2023-32337 | IBM Maximo Spatial Asset Management 安全漏洞 — Maximo Spatial Asset Management | 5.4 | Medium | 2024-01-19 |
| CVE-2024-0649 | ZhiHuiYun 代码问题漏洞 — ZhiHuiYun | 6.3 | Medium | 2024-01-17 |
| CVE-2024-22408 | Shopware 代码问题漏洞 — shopware | 7.6 | High | 2024-01-16 |
| CVE-2024-0601 | Austin 安全漏洞 — Austin | 6.3 | Medium | 2024-01-16 |
| CVE-2024-0510 | HaoKeKeJi YiQiNiu 代码问题漏洞 — YiQiNiu | 7.3 | High | 2024-01-13 |
| CVE-2024-0308 | Inis 代码问题漏洞 — Inis | 6.3 | Medium | 2024-01-08 |
| CVE-2024-0304 | Youke365 代码问题漏洞 — Youke365 | 6.3 | Medium | 2024-01-08 |
| CVE-2024-0303 | Youke365 安全漏洞 — Youke365 | 6.3 | Medium | 2024-01-08 |
| CVE-2023-51441 | Apache Axis 输入验证错误漏洞 — Apache Axis | 8.7 | - | 2024-01-06 |
| CVE-2024-21642 | Man Group D-Tale 代码问题漏洞 — dtale | 7.5 | High | 2024-01-05 |
| CVE-2023-51676 | WordPress Plugin Happy Addons for Elementor 代码问题漏洞 — Happy Addons for Elementor | 4.9 | Medium | 2023-12-29 |
| CVE-2023-7078 | Wrangler 安全漏洞 — miniflare | 7.5 | High | 2023-12-29 |
| CVE-2023-51665 | Audiobookshelf 代码问题漏洞 — audiobookshelf | 4.3 | Medium | 2023-12-27 |
| CVE-2023-51697 | Audiobookshelf 代码问题漏洞 — audiobookshelf | 4.3 | Medium | 2023-12-27 |
| CVE-2023-51451 | Symbolicator 安全漏洞 — symbolicator | 4.3 | Medium | 2023-12-22 |
| CVE-2023-50731 | MindsDB 代码问题漏洞 — mindsdb | 9.1 | Critical | 2023-12-22 |
| CVE-2023-50714 | yii2 安全漏洞 — yii2-authclient | 6.8 | Medium | 2023-12-22 |
| CVE-2023-50259 | Medusa 代码问题漏洞 — Medusa | 5.3 | Medium | 2023-12-22 |
| CVE-2023-50258 | Medusa 代码问题漏洞 — Medusa | 5.3 | Medium | 2023-12-22 |
| CVE-2023-7037 | automad 代码问题漏洞 — automad | 6.3 | Medium | 2023-12-21 |
| CVE-2023-6974 | Mlflow 代码问题漏洞 — mlflow/mlflow | 9.8 | - | 2023-12-20 |
| CVE-2022-40312 | WordPress Plugin GiveWP 代码问题漏洞 — GiveWP – Donation Plugin and Fundraising Platform | 5.5 | Medium | 2023-12-18 |
| CVE-2023-6853 | KodExplorer 代码问题漏洞 — KodExplorer | 6.3 | Medium | 2023-12-16 |
| CVE-2023-6852 | KodExplorer 代码问题漏洞 — KodExplorer | 6.3 | Medium | 2023-12-16 |
| CVE-2023-6849 | kodbox 代码问题漏洞 — kodbox | 7.3 | High | 2023-12-16 |
CWE-918（服务端请求伪造(SSRF)） 是常见的弱点类别，本平台收录该类弱点关联的 2359 条 CVE 漏洞。