1820
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1027 OWASP Top Ten 2017 Category A1 - Injection 1026 2435
MemberOf 1347 OWASP Top Ten 2021 Category A03:2021 - Injection 1344 2490
MemberOf 1409 Comprehensive Categorization: Injection 1400 2535
Notes
Maintenance
The interrelationships and differences between CWE-917 and CWE-1336 need to be further
clarified.
Relationship
In certain versions of Spring 3.0.5 and earlier, there was a vulnerability (CVE-2011-2730) in
which Expression Language tags would be evaluated twice, which effectively exposed any
application to EL injection. However, even for later versions, this weakness is still possible
depending on configuration.
References
[REF-911]Stefano Di Paola and Arshan Dabirsiaghi. "Expression Language Injection".
2011 September 2. < https://mindedsecurity.com/wp-content/uploads/2020/10/
ExpressionLanguageInjection.pdf >.2023-04-07.
[REF-912]Dan Amodio. "Remote Code with Expression Language Injection". 2012 December 4.
< http://danamodio.com/appsec/research/spring-remote-code-with-expression-language-injection/
>.2023-04-07.
[REF-1279]CWE/CAPEC. "Neutralizing Your Inputs: A Log4Shell Weakness Story". < https://
medium.com/@CWE_CAPEC/neutralizing-your-inputs-a-log4shell-weakness-story-89954c8b25c9
>.
[REF-1280]OWASP. "Expression Language Injection". < https://owasp.org/www-community/
vulnerabilities/Expression_Language_Injection >.
CWE-918: Server-Side Request Forgery (SSRF)
Weakness ID : 918
Structure : Simple
Abstraction : Base
Description
The web server receives a URL or similar request from an upstream component and retrieves
the contents of this URL, but it does not sufficiently ensure that the request is being sent to the
expected destination.
Extended Description
By providing URLs to unexpected hosts or ports, attackers can make it appear that the server
is sending the request, possibly bypassing access controls such as firewalls that prevent the
attackers from accessing the URLs directly. The server can be used as a proxy to conduct port
scanning of hosts in internal networks, use other URLs such as that can access documents on the
system (using file://), or use other protocols such as gopher:// or tftp://, which may provide greater
control over the contents of requests.
Relationships
CWE Version 4.14
CWE-918: Server-Side Request Forgery (SSRF)
CWE-918: Server-Side Request Forgery (SSRF)