Fallos del tipo CWE-918

3090 resultados

Server-Side Request Forgery (SSRF)

Ocorre quando a aplicação web busca conteúdo de uma URL fornecida pelo usuário sem validar adequadamente o destino. Um atacante consegue fazer o servidor requisitar URLs não autorizadas — internas, administrativas ou de terceiros — aproveitando a confiança e as permissões que o servidor possui na rede.

Ejemplo

Um sistema permite gerar thumbnails de imagens externas: o usuário passa uma URL e o servidor faz o download. Um atacante envia 'http://localhost:8080/admin' e consegue acessar painéis administrativos internos que não deveria. Ou envia 'http://169.254.169.254/latest/meta-data' em ambientes AWS e rouba credenciais.

Cómo mitigar

Mantenha uma whitelist rigorosa de domínios e IPs permitidos; bloqueie ranges privados (10.0.0.0/8, 127.0.0.0/8, 169.254.0.0/16) e metadados-servers por padrão; valide URLs antes de fazer requisições; use bibliotecas de parsing robustas; considere isolamento de rede para requisições externas.

CVE-2025-1912HIGHProduct Import Export for WooCommerce <= 2.5.0 - Authenticated (Administrator+) Server-Side Request Forgery via validate_file FunctionEPSS 0.4%CVE-2026-7657MEDIUMLangflow OSS is affected by server-side request forgery in provider validation and API request functionalityEPSS 0.4%CVE-2025-61784HIGHLLaMA Factory's Chat API has Critical SSRF and LFI VulnerabilitiesEPSS 0.4%CVE-2026-72855HIGHBudibase before 3.40.0 DNS Rebinding SSRF via OpenAPI and RESTEPSS 0.4%CVE-2026-73497MEDIUMMCP Atlassian is a Model Context Protocol (MCP): DNS-rebinding TOCTOU bypass of the SSRF fix (CVE-2026-27826): unauthenticated SSRF to cloud metadataEPSS 0.4%CVE-2026-39965HIGHTypeBot: SSRF via Open Redirect Bypass in HTTP Request and Code BlocksEPSS 0.4%CVE-2026-35032HIGHJellyfin: Potential SSRF + Arbitrary file read via LiveTV M3U tunerEPSS 0.4%CVE-2026-47684HIGHSync-in Server: SSRF protection bypass via IPv4-mapped IPv6 addresses in regExpPrivateIPEPSS 0.4%CVE-2026-56677HIGH9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test EndpointEPSS 0.4%CVE-2026-79717MEDIUMGalaxy_ng: galaxy_ng: blind ssrf via namespace avatar_url with no private-address restrictionEPSS 0.4%CVE-2026-92184MEDIUMag-ui-protocol ag-ui Multimodal Content utils.py urllib.request.urlopen server-side request forgeryEPSS 0.4%CVE-2026-40089CRITICALSonicverse has Server-Side Request Forgery via user-controlled URLs in dashboard API clientEPSS 0.4%CVE-2026-1648HIGHPerformance Monitor <= 1.0.6 - Unauthenticated Server-Side Request Forgery via 'url' ParameterEPSS 0.4%CVE-2026-16222MEDIUM1Panel-dev CordysCRM Third Party Endpoint TokenService.java server-side request forgeryEPSS 0.4%CVE-2025-45474HIGHmaccms10 v2025.1000.4047 is vulnerable to Server-side request forgery (SSRF) in Email Settings.EPSS 0.4%CVE-2026-15628MEDIUMzhayujie chatgpt-on-wechat CowAgent Vision Tool vision.py Vision._download_to_data_url server-side request forgeryEPSS 0.4%CVE-2026-14748MEDIUMAIAnytime Awesome-MCP-Server mcp-wiki/wiki-summary server.py server-side request forgeryEPSS 0.4%CVE-2026-15525MEDIUMkLOsk adloop write.py _validate_urls server-side request forgeryEPSS 0.4%CVE-2026-13540MEDIUMGitBucket RepositoryCreationService.scala Git.cloneRepository.setURI server-side request forgeryEPSS 0.4%CVE-2026-90790MEDIUMa2aproject a2a-python Push Notification Sender base_push_notification_sender.py _dispatch_notification server-side request forgeryEPSS 0.4%