Weaknesses of type CWE-918

3,097 results

Falsificação de Solicitação no Servidor (SSRF)

O servidor web recupera conteúdo de uma URL fornecida pelo usuário sem validar adequadamente o destino. Isso permite que um atacante force o servidor a fazer requisições para hosts internos, serviços privados ou sistemas que não deveriam ser acessíveis, contornando controles de rede e autenticação.

Example

Uma aplicação oferece um proxy de imagens: recebe a URL 'http://exemplo.com/foto.jpg' e retorna o conteúdo. Um atacante envia 'http://localhost:8080/admin' ou 'http://192.168.1.100/dados-internos', forçando o servidor a acessar sistemas internos e exfiltrar dados sensíveis.

How to mitigate

Valide e faça whitelist de domínios/IPs permitidos antes de fazer a requisição; rejeite URLs locais, privadas (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) e metadados (169.254.169.254); use DNS pinning e resoluções contínuas. Em clouds, restrinja acesso ao serviço de metadados via iptables ou IMDSv2.

CVE-2026-73497MEDIUMMCP Atlassian is a Model Context Protocol (MCP): DNS-rebinding TOCTOU bypass of the SSRF fix (CVE-2026-27826): unauthenticated SSRF to cloud metadataEPSS 0.4%CVE-2025-1912HIGHProduct Import Export for WooCommerce <= 2.5.0 - Authenticated (Administrator+) Server-Side Request Forgery via validate_file FunctionEPSS 0.4%CVE-2026-39965HIGHTypeBot: SSRF via Open Redirect Bypass in HTTP Request and Code BlocksEPSS 0.4%CVE-2026-35032HIGHJellyfin: Potential SSRF + Arbitrary file read via LiveTV M3U tunerEPSS 0.4%CVE-2025-61784HIGHLLaMA Factory's Chat API has Critical SSRF and LFI VulnerabilitiesEPSS 0.4%CVE-2026-56677HIGH9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test EndpointEPSS 0.4%CVE-2026-72855HIGHBudibase before 3.40.0 DNS Rebinding SSRF via OpenAPI and RESTEPSS 0.4%CVE-2026-7657MEDIUMLangflow OSS is affected by server-side request forgery in provider validation and API request functionalityEPSS 0.4%CVE-2026-47684HIGHSync-in Server: SSRF protection bypass via IPv4-mapped IPv6 addresses in regExpPrivateIPEPSS 0.4%CVE-2026-5803MEDIUMbigsk1 openai-realtime-ui API Proxy Endpoint server.js server-side request forgeryEPSS 0.4%CVE-2026-1648HIGHPerformance Monitor <= 1.0.6 - Unauthenticated Server-Side Request Forgery via 'url' ParameterEPSS 0.4%CVE-2026-40089CRITICALSonicverse has Server-Side Request Forgery via user-controlled URLs in dashboard API clientEPSS 0.4%CVE-2026-13540MEDIUMGitBucket RepositoryCreationService.scala Git.cloneRepository.setURI server-side request forgeryEPSS 0.4%CVE-2026-92184MEDIUMag-ui-protocol ag-ui Multimodal Content utils.py urllib.request.urlopen server-side request forgeryEPSS 0.4%CVE-2026-15525MEDIUMkLOsk adloop write.py _validate_urls server-side request forgeryEPSS 0.4%CVE-2026-79717MEDIUMGalaxy_ng: galaxy_ng: blind ssrf via namespace avatar_url with no private-address restrictionEPSS 0.4%CVE-2026-15628MEDIUMzhayujie chatgpt-on-wechat CowAgent Vision Tool vision.py Vision._download_to_data_url server-side request forgeryEPSS 0.4%CVE-2025-45474HIGHmaccms10 v2025.1000.4047 is vulnerable to Server-side request forgery (SSRF) in Email Settings.EPSS 0.4%CVE-2026-14748MEDIUMAIAnytime Awesome-MCP-Server mcp-wiki/wiki-summary server.py server-side request forgeryEPSS 0.4%CVE-2026-16223MEDIUM1Panel-dev CordysCRM Third Party Edit Endpoint IntegrationConfigService.java getSqlBotSrc server-side request forgeryEPSS 0.4%