1364
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 417 Communication Channel Errors 2325
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Technology : Web Server (Prevalence = Undetermined)
Alternate Terms
XSPA : Cross Site Port Attack
Common Consequences
Scope Impact Likelihood
Confidentiality Read Application Data
Integrity Execute Unauthorized Code or Commands
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Observed Examples
Reference Description
CVE-2021-26855 Server Side Request Forgery (SSRF) in mail server, as exploited in the wild
per CISA KEV.
https://www.cve.org/CVERecord?id=CVE-2021-26855
CVE-2021-21973 Server Side Request Forgery in cloud platform, as exploited in the wild per
CISA KEV.
https://www.cve.org/CVERecord?id=CVE-2021-21973
CVE-2016-4029 Chain: incorrect validation of intended decimal-based IP address format
(CWE-1286) enables parsing of octal or hexadecimal formats (CWE-1389),
allowing bypass of an SSRF protection mechanism (CWE-918).
https://www.cve.org/CVERecord?id=CVE-2016-4029
CWE Version 4.14
CWE-918: Server-Side Request Forgery (SSRF)
CWE-918: Server-Side Request Forgery (SSRF)