Fallos del tipo CWE-918

3091 resultados

Server-Side Request Forgery (SSRF)

Ocorre quando a aplicação web busca conteúdo de uma URL fornecida pelo usuário sem validar adequadamente o destino. Um atacante consegue fazer o servidor requisitar URLs não autorizadas — internas, administrativas ou de terceiros — aproveitando a confiança e as permissões que o servidor possui na rede.

Ejemplo

Um sistema permite gerar thumbnails de imagens externas: o usuário passa uma URL e o servidor faz o download. Um atacante envia 'http://localhost:8080/admin' e consegue acessar painéis administrativos internos que não deveria. Ou envia 'http://169.254.169.254/latest/meta-data' em ambientes AWS e rouba credenciais.

Cómo mitigar

Mantenha uma whitelist rigorosa de domínios e IPs permitidos; bloqueie ranges privados (10.0.0.0/8, 127.0.0.0/8, 169.254.0.0/16) e metadados-servers por padrão; valide URLs antes de fazer requisições; use bibliotecas de parsing robustas; considere isolamento de rede para requisições externas.

CVE-2026-79717MEDIUMGalaxy_ng: galaxy_ng: blind ssrf via namespace avatar_url with no private-address restrictionEPSS 0.4%CVE-2026-13540MEDIUMGitBucket RepositoryCreationService.scala Git.cloneRepository.setURI server-side request forgeryEPSS 0.4%CVE-2026-16223MEDIUM1Panel-dev CordysCRM Third Party Edit Endpoint IntegrationConfigService.java getSqlBotSrc server-side request forgeryEPSS 0.4%CVE-2026-33234MEDIUMAutoGPT: SendEmailBlock's IP blocklist bypass allows SSRF via user-controlled SMTP serverEPSS 0.4%CVE-2026-27945LOWZITADEL has potential SSRF via ActionsEPSS 0.4%CVE-2026-91938HIGHFlowise before 3.1.4 Server-Side Request Forgery via document loadersEPSS 0.4%CVE-2024-53983MEDIUMServer-side request forgery in Backstage Scaffolder pluginEPSS 0.4%CVE-2023-29008HIGHSvelteKit framework has Insufficient CSRF protection for CORS requestsEPSS 0.4%CVE-2025-44594CRITICALhalo v2.20.17 and before is vulnerable to server-side request forgery (SSRF) in /apis/uc.api.storage.halo.run/v1alpha1/attachments/-/upload-EPSS 0.4%CVE-2026-42335MEDIUMMaxKB: SSRF Bypass in MaxKB OSS URL Fetch due to URL Parsing DiscrepancyEPSS 0.4%CVE-2026-56663HIGHAutoGPT: SSRF-to-RCE Chain in `SendWebRequestBlock` via IP validation bypass and internal `pg-meta` accessEPSS 0.4%CVE-2026-30839MEDIUMWallos: SSRF via webhook test endpointEPSS 0.4%CVE-2026-33975HIGHtwenty-server SSRF protection bypass via IPv4-mapped IPv6 address normalizationEPSS 0.4%CVE-2026-86122MEDIUMRowboat through 0.9.1 Server-Side Request Forgery via Custom MCP ServerEPSS 0.4%CVE-2026-45741HIGHGotenberg: SSRF deny-list bypass in IsPublicIP via IPv6 6to4 / NAT64 / site-local prefixesEPSS 0.4%CVE-2026-54546MEDIUMCloudTAK: Authenticated full-read SSRF in CloudTAK basemap import (PUT /api/basemap) — no IP-classification guardEPSS 0.4%CVE-2026-26379MEDIUMKoha versions up to 25.11 contain a Server-Side Request Forgery (SSRF) vulnerability via the Z39.50/SRU server configuration. This allows auEPSS 0.4%CVE-2023-45705LOWHCL BigFix Platform is susceptible to Server Side Request Forgery (SSRF)EPSS 0.4%CVE-2026-88896MEDIUMEspoCRM before 10.0.4 SSRF via IPv6 Transition Address BypassEPSS 0.4%CVE-2026-48916MEDIUMJenkins LDAP Plugin 807.v7d7de30930cf and earlier follows LDAP referrals.EPSS 0.4%