Weaknesses of type CWE-918

3,105 results

Falsificação de Solicitação no Servidor (SSRF)

O servidor web recupera conteúdo de uma URL fornecida pelo usuário sem validar adequadamente o destino. Isso permite que um atacante force o servidor a fazer requisições para hosts internos, serviços privados ou sistemas que não deveriam ser acessíveis, contornando controles de rede e autenticação.

Example

Uma aplicação oferece um proxy de imagens: recebe a URL 'http://exemplo.com/foto.jpg' e retorna o conteúdo. Um atacante envia 'http://localhost:8080/admin' ou 'http://192.168.1.100/dados-internos', forçando o servidor a acessar sistemas internos e exfiltrar dados sensíveis.

How to mitigate

Valide e faça whitelist de domínios/IPs permitidos antes de fazer a requisição; rejeite URLs locais, privadas (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) e metadados (169.254.169.254); use DNS pinning e resoluções contínuas. Em clouds, restrinja acesso ao serviço de metadados via iptables ou IMDSv2.

CVE-2026-22664HIGHprompts.chat SSRF via Fal.ai Media Status PollingEPSS 0.3%CVE-2026-70551HIGHServer-Side Request Forgery Via VCS remote download in JFrog ArtifactoryEPSS 0.3%CVE-2025-10695MEDIUMOpenSupports 4.11.0 — SSRF via test imap and smtp endpointsEPSS 0.3%CVE-2026-26005MEDIUMClipBucket v5 enables internal network scans via an SSRF vulnerabilityEPSS 0.3%CVE-2026-60091MEDIUMPraisonAI before 4.6.78 Unauthenticated SSRF via webhook_urlEPSS 0.3%CVE-2026-77522MEDIUMMaxKB: Authenticated full-read SSRF via the knowledge web-document import/sync crawler (Fork.fork requests.get, no internal-IP guard, non-blind)EPSS 0.3%CVE-2026-95930MEDIUMiFlytek astron-agent debugToolV2 API endpoint UrlCheckTool.checkUrl server-side request forgeryEPSS 0.3%CVE-2026-42860HIGHOpen edx Enterprise Service: SSRF via SAML metadata URL in sync_provider_data endpointEPSS 0.3%CVE-2026-83543MEDIUMGreenshift < 13.2.0 - Contributor+ SSRF via get-csv-to-json REST EndpointEPSS 0.3%CVE-2026-76361LOWServer-Side Request Forgery (SSRF) through the Connectivity Check REST API in Splunk SOAREPSS 0.3%CVE-2026-33644LOWLychee has SSRF bypass via DNS rebinding — PhotoUrlRule only validates IP addresses, not hostnames resolving to internal IPsEPSS 0.3%CVE-2026-33537MEDIUMLychee has SSRF bypass via incomplete IP validation in Photo::fromUrl — loopback and link-local IPs not blockedEPSS 0.3%CVE-2025-1043MEDIUMEmbed Any Document – Embed PDF, Word, PowerPoint and Excel Files <= 2.7.5 - Authenticated (Contributor+) Blind Server-Side Request Forgery via embeddoc ShortcodeEPSS 0.3%CVE-2025-30680HIGHA Server-side Request Forgery (SSRF) vulnerability in Trend Micro Apex Central (SaaS) could allow an attacker to manipulate certain parameteEPSS 0.3%CVE-2024-22329MEDIUMIBM WebSphere Application Server server-side request forgeryEPSS 0.3%CVE-2026-76559MEDIUMWP Import Export Lite < 3.9.33 - Admin+ SSRF via Import URL HandlingEPSS 0.3%CVE-2026-101005MEDIUMOctober CMS SSRF Protection ResizeImages.php validateExternalImageHost server-side request forgeryEPSS 0.3%CVE-2026-34719HIGHZammad has a Server-side request forgery (SSRF) via webhooksEPSS 0.3%CVE-2026-33060MEDIUMCKAN MCP Server: SSRF via base_url allows access to internal networksEPSS 0.3%CVE-2026-19352LOWmifi lossless-cut Built-in HTTP API Service httpServer.ts server-side request forgeryEPSS 0.3%