Weaknesses of type CWE-918

3,091 results

Falsificação de Solicitação no Servidor (SSRF)

O servidor web recupera conteúdo de uma URL fornecida pelo usuário sem validar adequadamente o destino. Isso permite que um atacante force o servidor a fazer requisições para hosts internos, serviços privados ou sistemas que não deveriam ser acessíveis, contornando controles de rede e autenticação.

Example

Uma aplicação oferece um proxy de imagens: recebe a URL 'http://exemplo.com/foto.jpg' e retorna o conteúdo. Um atacante envia 'http://localhost:8080/admin' ou 'http://192.168.1.100/dados-internos', forçando o servidor a acessar sistemas internos e exfiltrar dados sensíveis.

How to mitigate

Valide e faça whitelist de domínios/IPs permitidos antes de fazer a requisição; rejeite URLs locais, privadas (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) e metadados (169.254.169.254); use DNS pinning e resoluções contínuas. Em clouds, restrinja acesso ao serviço de metadados via iptables ou IMDSv2.

CVE-2025-2116MEDIUMBeijing Founder Electronics Founder Enjoys All-Media Acquisition and Editing System File Protocol imageProxy.do server-side request forgeryEPSS 0.4%CVE-2025-27217CRITICALA Server-Side Request Forgery (SSRF) in the UISP Application may allow a malicious actor with certain permissions to make requests outside oEPSS 0.4%CVE-2026-46698MEDIUMFediverse Embeds: Public-nonce SSRF via ftf_get_site_info AJAX actionEPSS 0.4%CVE-2026-90486MEDIUMopenstatusHQ openstatus resolve-custom-domain-rewrite.ts server-side request forgeryEPSS 0.4%CVE-2026-12774MEDIUMBerriAI litellm MCP Server Connection Testing rest_endpoints.py _execute_with_mcp_client server-side request forgeryEPSS 0.4%CVE-2025-63408MEDIUMLocal Agent DVR versions thru 6.6.1.0 are vulnerable to directory traversal that allows an unauthenticated local attacker to gain access to EPSS 0.4%CVE-2026-30232HIGHChartbrew has SSRF in API Data Connection - No IP Validation on User-Provided URLsEPSS 0.4%CVE-2026-10055HIGHIn Eclipse Theia since version 1.26.0, the backend /services/request-service RPC accepts an attacker-controlled URL from any client connecteEPSS 0.4%CVE-2026-44284MEDIUMFastGPT: Stored MCP tool URL SSRF in FastGPT workflow executionEPSS 0.4%CVE-2026-51583HIGHAn issue in usememos through v0.30.0 allows a remote authenticated attacker to perform Server-Side Request Forgery (SSRF) via the Webhook vaEPSS 0.4%CVE-2026-54549HIGHMeta Ads MCP: Server-Side Request Forgery (SSRF) in `upload_ad_image` via Unrestricted `image_url` FetchEPSS 0.4%CVE-2026-25765MEDIUMFaraday affected by SSRF via protocol-relative URL host override in build_exclusive_urlEPSS 0.4%CVE-2026-11546HIGHIBM WebSphere Application Server Liberty is affected by a server-side request forgery vulnerabilityEPSS 0.4%CVE-2026-40566MEDIUMFreeScout vulnerable to SSRF via IMAP/SMTP Connection Test EndpointsEPSS 0.4%CVE-2026-85662MEDIUMMarqo 2.26.0 Server-Side Request Forgery via Media URLsEPSS 0.4%CVE-2026-15620MEDIUMmosaxiv clawlet tool_web_fetch.go tools.webFetch server-side request forgeryEPSS 0.4%CVE-2026-40160HIGHPraisonAIAgents has SSRF via unvalidated URL in `web_crawl` httpx fallbackEPSS 0.4%CVE-2026-15668MEDIUMlouisho5 picobot web Tool web.go WebTool.Execute server-side request forgeryEPSS 0.4%CVE-2026-19340MEDIUManubissbe ProjectHub-Mcp Webhooks API complete_backend.js server-side request forgeryEPSS 0.4%CVE-2025-2192MEDIUMStoque Zeev.it Login Page server-side request forgeryEPSS 0.4%