CWE-918: Server-Side Request Forgery (SSRF)

Code Examples & CVEs

Demonstrative Examples

This code intends to receive a URL from a user, access the URL, and return the results to the user.

The given PHP code is vulnerable to Server-Side Request Forgery (SSRF) because it directly accepts a user-supplied URL from the $_GET['url'] parameter and fetches its content using file_get_contents(), without any validation or restrictions. This allows an attacker to request internal or restricted resources within the server's network, such as internal admin panels, cloud metadata endpoints, or local services running on localhost.

BadPHP

$url = $_GET['url'];# User-controlled input                                            # Fetch the content of the provided URL                      $response = file_get_contents($url); 					 echo $response;

This code intends to receive a URL from a user, access the URL, and return the results to the user.

GoodPHP

# Define allowed URLs (or domains)$allowed_urls = ['https://example.com/data.json','https://api.example.com/info',];# Get the user-provided URL$url = $_GET['url'] ?? '';# Validate against allowed URLsif (!in_array($url, $allowed_urls)) {http_response_code(400);echo "Invalid or unauthorized URL.";exit;}# Fetch content safely$response = @file_get_contents($url);if ($response === false) {http_response_code(500);echo "Failed to fetch content.";exit;}echo htmlspecialchars($response);# Escape output for safety

Observed CVE Examples (10)

CVE-2026-33626

SSRF in LLM toolkit accesses arbitrary URLs for images, as exploited in the wild in April 2026 to conduct port scanning [REF-1519]

View Details

CVE-2024-3095

SSRF in LLM application development framework because the URL retriever allows connections to local addresses using a crafted Location header

View Details

CVE-2023-32786

Chain: LLM integration framework has prompt injection (CWE-1427) that allows an attacker to force the service to retrieve data from an arbitrary URL, essentially providing SSRF (CWE-918) and potentially injecting content into downstream tasks.

View Details

CVE-2021-26855

Server Side Request Forgery (SSRF) in mail server, as exploited in the wild per CISA KEV.

View Details

CVE-2021-21973

Server Side Request Forgery in cloud platform, as exploited in the wild per CISA KEV.

View Details

CVE-2016-4029

Chain: incorrect validation of intended decimal-based IP address format (CWE-1286) enables parsing of octal or hexadecimal formats (CWE-1389), allowing bypass of an SSRF protection mechanism (CWE-918).

View Details

CVE-2002-1484

Web server allows attackers to request a URL from another server, including other ports, which allows proxied scanning.

View Details

CVE-2004-2061

CGI script accepts and retrieves incoming URLs.

View Details

CVE-2010-1637

Web-based mail program allows internal network scanning using a modified POP3 port number.

View Details

CVE-2009-0037

URL-downloading library automatically follows redirects to file:// and scp:// URLs

View Details

Source-backed guidance

Additional facts reviewed against primary or authoritative security sources.

Combine review and analysis around the CWE-918 trust boundary

MITRE identifies automated static analysis as applicable detection approaches. Use them to trace attacker-influenced URLs, hosts, redirects, and resolver results into outbound clients and verify validation survives parsing, DNS resolution, redirects, and alternate address forms. Require a reproducible source-to-sink or policy-to-enforcement trace, record coverage gaps, and confirm suspected findings dynamically where safe; no single scanner can establish complete coverage for this weakness.

CWE-918: detection methods and operational guidance — MITRE CWE

Constrain both the SSRF destination and network path

Avoid accepting a complete URL when the application only needs a host, address, or identifier. Parse and validate each value with a maintained library, allowlist known destinations where possible, disable redirect following, and prevent outbound access to loopback, private, link-local, and cloud-metadata networks. Enforce the same restrictions with egress firewall or network rules as defense in depth.

Server Side Request Forgery Prevention Cheat Sheet — OWASP Foundation

Apply lessons from CVE-2021-22175 in GitLab

NVD maps CVE-2021-22175 to CWE-918; external users could use the CI Lint API to cause server-side requests when internal-network webhook requests were enabled. Use the case to test non-obvious URL consumers, apply destination controls consistently across features, and ensure enabling one integration does not relax outbound policy for unrelated endpoints.

CVE-2021-22175 Detail — NIST National Vulnerability Database

Prioritize CWE-918 using its 2025 CWE Top 25 evidence

CWE-918 ranked #22 in the 2025 CWE Top 25 with a score of 3.36. The ranking table recorded no mapped vulnerabilities in CISA KEV for this measurement window. Use the rank to prioritize systemic prevention, detection coverage, and recurring-root-cause metrics across the portfolio, while retaining asset exposure and business impact for individual finding severity decisions.

2025 CWE Top 25 Most Dangerous Software Weaknesses — MITRE CWE

Probe internal destinations and validation/parser mismatches

Identify features that fetch URLs, webhooks, imports, previews, or remote images. Test loopback, private, link-local, metadata, IPv6, integer and encoded addresses, user-info confusion, redirects, and DNS changes using a controlled listener. Confirm the application validates the parsed destination and resolved addresses at each hop and that network egress rules independently block internal targets.

Testing for Server-Side Request Forgery — OWASP Foundation

Frequently Asked Questions

What is CWE-918: Server-Side Request Forgery (SSRF)?+

CWE-918: Server-Side Request Forgery (SSRF) is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Is CWE-918 in the CWE Top 25 Most Dangerous Software Weaknesses?+

Yes. CWE-918 ranked #14 in the CWE Top 25 for 2024, associated with 306 CVEs that year. The CWE Top 25 highlights the most common and impactful software weaknesses based on real-world vulnerability data.

What are the security consequences of Server-Side Request Forgery (SSRF)?+

If exploited, CWE-918 (Server-Side Request Forgery (SSRF)) it can compromise Confidentiality, Integrity and Access Control, leading to outcomes such as Read Application Data, Execute Unauthorized Code or Commands and Bypass Protection Mechanism.

Which programming languages are affected by Server-Side Request Forgery (SSRF)?+

CWE-918 commonly affects Not Language-Specific. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.

What are real-world examples of Server-Side Request Forgery (SSRF)?+

MITRE documents real CVEs mapped to CWE-918, including CVE-2026-33626, CVE-2024-3095, CVE-2023-32786, CVE-2021-26855 and CVE-2021-21973. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.

What is the difference between a CWE and a CVE?+

A CWE (Common Weakness Enumeration) like CWE-918 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.

CWE-918: Server-Side Request Forgery (SSRF)

Technical Details

Applicable To

🏆 CWE Top 25 Historical Ranking

Security Consequences

Scope

Impact

Scope

Impact

Scope

Impact

Mitigation Strategies

Detection Methods

Code Examples & CVEs

Demonstrative Examples

Observed CVE Examples (10)

CWE Relationships

Parent Weaknesses

Source-backed guidance

Combine review and analysis around the CWE-918 trust boundary

Constrain both the SSRF destination and network path

Apply lessons from CVE-2021-22175 in GitLab

Prioritize CWE-918 using its 2025 CWE Top 25 evidence

Probe internal destinations and validation/parser mismatches

Frequently Asked Questions

Learn More