CWE-918 服务端请求伪造(SSRF) 类弱点 2359 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-918 服务端请求伪造（SSRF）是一种允许攻击者诱导服务器发起恶意请求的漏洞。当服务器接收外部提供的 URL 并据此获取内容时，若未严格校验目标地址，攻击者可构造请求访问内网资源或探测内部服务，从而绕过防火墙限制。开发者应实施严格的白名单机制，限制协议类型，禁用重定向，并对所有输入进行深度验证，确保请求仅能访问预期的合法外部资源，从而有效防御此类攻击。
$url = $_GET['url']; # User-controlled input # Fetch the content of the provided URL $response = file_get_contents($url); echo $response;# Define allowed URLs (or domains) $allowed_urls = [ 'https://example.com/data.json', 'https://api.example.com/info', ]; # Get the user-provided URL $url = $_GET['url'] ?? ''; # Validate against allowed URLs if (!in_array($url, $allowed_urls)) { http_response_code(400); echo "Invalid or unauthorized URL."; exit; } # Fetch content safely $response = @file_get_contents($url); if ($response === false) { http_response_code(500); echo "Failed to fetch content."; exit; } echo htmlspecialchars($response); # Escape output for safety| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2022-35949 | undici 代码问题漏洞 — undici | 5.3 | Medium | 2022-08-12 |
| CVE-2022-2756 | kavita 代码问题漏洞 — kareadita/kavita | 6.5 | - | 2022-08-10 |
| CVE-2022-31132 | Nextcloud 代码问题漏洞 — security-advisories | 8.3 | High | 2022-08-04 |
| CVE-2022-31188 | CVAT 代码问题漏洞 — cvat | 8.6 | High | 2022-08-01 |
| CVE-2022-32457 | Digiwin BPM 代码问题漏洞 — BPM | 5.3 | Medium | 2022-07-20 |
| CVE-2022-2339 | NocoDB 代码问题漏洞 — nocodb/nocodb | 6.5 | - | 2022-07-07 |
| CVE-2022-0085 | Dompdf 代码问题漏洞 — dompdf/dompdf | 7.5 | - | 2022-06-28 |
| CVE-2017-20106 | Khoros Forum 代码问题漏洞 — Forum | 5.3 | Medium | 2022-06-28 |
| CVE-2022-2216 | parse-url 代码问题漏洞 — ionicabizau/parse-url | 7.5 | - | 2022-06-27 |
| CVE-2022-1977 | WordPress plugin WP Ultimate CSV Importer 代码问题漏洞 — Import Export All WordPress Images, Users & Post Types | 6.5 | - | 2022-06-27 |
| CVE-2022-23080 | Directus 代码问题漏洞 — directus | 5.0 | - | 2022-06-22 |
| CVE-2022-23071 | Recipes 代码问题漏洞 — recipes | 6.5 | - | 2022-06-19 |
| CVE-2022-29612 | SAP Host Agent 代码问题漏洞 — SAP NetWeaver, ABAP Platform and SAP Host Agent | - | - | 2022-06-14 |
| CVE-2022-28217 | SAP NetWeaver 代码问题漏洞 — SAP NetWeaver (EP Web Page Composer) | 6.5 | - | 2022-06-13 |
| CVE-2022-24969 | Apache Dubbo 代码问题漏洞 — Apache Dubbo | 6.1 | - | 2022-06-06 |
| CVE-2022-1285 | Gogs 代码问题漏洞 — gogs/gogs | 8.2 | - | 2022-06-01 |
| CVE-2021-40186 | DNN 代码问题漏洞 — DNN Platform | 6.5 | Medium | 2022-05-31 |
| CVE-2022-29188 | Smokescreen 代码问题漏洞 — smokescreen | 5.3 | Medium | 2022-05-20 |
| CVE-2022-1784 | JGraph draw.io 代码问题漏洞 — jgraph/drawio | 7.5 | - | 2022-05-20 |
| CVE-2022-1767 | JGraph draw.io 代码问题漏洞 — jgraph/drawio | 7.5 | - | 2022-05-18 |
| CVE-2022-24856 | FlyteConsole 代码问题漏洞 — flyteconsole | 9.1 | Critical | 2022-05-17 |
| CVE-2022-1711 | JGraph draw.io 代码问题漏洞 — jgraph/drawio | 7.5 | - | 2022-05-17 |
| CVE-2022-1723 | JGraph draw.io 代码问题漏洞 — jgraph/drawio | 7.5 | - | 2022-05-17 |
| CVE-2022-1713 | JGraph draw.io 代码问题漏洞 — jgraph/drawio | 7.5 | - | 2022-05-16 |
| CVE-2022-1722 | JGraph draw.io 代码问题漏洞 — jgraph/drawio | 6.2 | - | 2022-05-16 |
| CVE-2022-1398 | WordPress plugin External Media without Import 代码问题漏洞 — External Media without Import | 6.5 | - | 2022-05-16 |
| CVE-2022-1386 | WordPress plugin Fusion Builder 代码问题漏洞 — Fusion Builder | 9.1 | - | 2022-05-16 |
| CVE-2022-1379 | PlantUML 代码问题漏洞 — plantuml/plantuml | 10.0 | - | 2022-05-14 |
| CVE-2022-29180 | Charm 代码问题漏洞 — charm | 5.9 | Medium | 2022-05-07 |
| CVE-2022-1592 | Clinical-Genomics Scout 代码问题漏洞 — clinical-genomics/scout | 8.2 | - | 2022-05-05 |
CWE-918（服务端请求伪造(SSRF)） 是常见的弱点类别，本平台收录该类弱点关联的 2359 条 CVE 漏洞。