Weaknesses of type CWE-918

3,099 results

Falsificação de Solicitação no Servidor (SSRF)

O servidor web recupera conteúdo de uma URL fornecida pelo usuário sem validar adequadamente o destino. Isso permite que um atacante force o servidor a fazer requisições para hosts internos, serviços privados ou sistemas que não deveriam ser acessíveis, contornando controles de rede e autenticação.

Example

Uma aplicação oferece um proxy de imagens: recebe a URL 'http://exemplo.com/foto.jpg' e retorna o conteúdo. Um atacante envia 'http://localhost:8080/admin' ou 'http://192.168.1.100/dados-internos', forçando o servidor a acessar sistemas internos e exfiltrar dados sensíveis.

How to mitigate

Valide e faça whitelist de domínios/IPs permitidos antes de fazer a requisição; rejeite URLs locais, privadas (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) e metadados (169.254.169.254); use DNS pinning e resoluções contínuas. Em clouds, restrinja acesso ao serviço de metadados via iptables ou IMDSv2.

CVE-2023-51665MEDIUMAudiobookshelf vulnerable to Blind SSRF in `Auth.js`EPSS 0.3%CVE-2023-51697MEDIUMAudiobookshelf vulnerable to Blind SSRF in `podcastUtils.js`EPSS 0.3%CVE-2026-42591HIGHGotenberg: Server-Side Request Forgery (SSRF) in github.com/gotenberg/gotenberg/v8EPSS 0.3%CVE-2026-85732MEDIUMoras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probingEPSS 0.3%CVE-2026-83744MEDIUMinvoiceninja Invoice Ninja invoices Endpoint Purify.php isHostSafe server-side request forgeryEPSS 0.3%CVE-2026-28416HIGHGradio has SSRF via Malicious `proxy_url` Injection in `gr.load()` Config ProcessingEPSS 0.3%CVE-2026-0745MEDIUMUser Language Switch <= 1.6.10 - Authenticated (Administrator+) Server-Side Request Forgery via 'info_language' ParameterEPSS 0.3%CVE-2026-12564CRITICALAutomation-controller: automation-controller: kubernetes service account token exfiltration via hashicorp vault credential ssrfEPSS 0.3%CVE-2026-84207MEDIUMHeym before 0.0.98 SSRF via WebSocket endpointsEPSS 0.3%CVE-2026-28680CRITICALGhostfolio: Full-Read SSRF in Manual Asset ImportEPSS 0.3%CVE-2026-3189LOWfeiyuchuixue sz-boot-parent download server-side request forgeryEPSS 0.3%CVE-2026-61430HIGHPraisonAI before 1.6.78 DNS Rebinding SSRF via web_crawlEPSS 0.3%CVE-2026-85650MEDIUMTrigger.dev before 4.5.2 Server-Side Request Forgery via webhook alert-channelEPSS 0.3%CVE-2025-14518MEDIUMPowerJob Network Request PingPongUtils.java checkConnectivity server-side request forgeryEPSS 0.3%CVE-2026-44936MEDIUMRancher Fleet SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yamlEPSS 0.3%CVE-2026-61429HIGHPraisonAI before 1.6.78 SSRF via Crawl4AI Chromium backendEPSS 0.3%CVE-2024-37157MEDIUMDiscourse vulnerable to Server-Side Request Forgery via FastImageEPSS 0.3%CVE-2026-3966MEDIUM648540858 wvp-GB28181-pro IP Address ABLMediaNodeServerService.java getDownloadFilePath server-side request forgeryEPSS 0.3%CVE-2026-82866HIGH@pdfme/common before 5.5.10 SSRF via Unvalidated URL FetchEPSS 0.3%CVE-2026-15508MEDIUMHelicone ai-gateway AWS Metadata Service service.rs build_target_url server-side request forgeryEPSS 0.3%