Falhas do tipo CWE-918

3.097 resultados

Falsificação de Solicitação do Lado do Servidor (SSRF)

O servidor web recebe uma URL de um cliente e a recupera sem validar adequadamente o destino, permitindo que um atacante redirecione requisições para hosts internos, serviços privados ou IPs arbitrários. O risco é grave: exposição de dados internos, acesso a serviços administrativos, varredura de rede interna e até execução de código em sistemas conectados.

Exemplo

Uma aplicação oferece um recurso de 'baixar imagem de URL': o usuário envia `https://attacker.com/fetch?url=http://localhost:8080/admin`, e o servidor, sem validar, faz a requisição e retorna o conteúdo da página admin interna ou de um banco de dados local exposto.

Como mitigar

Valide e liste explicitamente domínios/IPs permitidos (whitelist), bloqueie ranges de IPs privados (10.0.0.0/8, 127.0.0.0/8, 169.254.0.0/16, 172.16.0.0/12, 192.168.0.0/16), use esquemas de URL permitidos (apenas http/https) e desabilite redirects automáticos ou validar o destino final. Considere usar um proxy ou gateway isolado para requisições externas.

CVE-2026-35629MEDIUMOpenClaw < 2026.3.25 - Server-Side Request Forgery via Unguarded Configured Base URLs in Channel ExtensionsEPSS 0.3%CVE-2026-5623MEDIUMhcengineering Huly Platform Import Endpoint index.ts server-side request forgeryEPSS 0.3%CVE-2026-67101CRITICALHCL BigFix Service Management is affected by multiple security vulnerabilities.EPSS 0.3%CVE-2026-75871HIGHServer-Side Request Forgery (SSRF) in GitLab AI GatewayEPSS 0.3%CVE-2025-14443MEDIUMOse-openshift-apiserver: openshift api server: server-side request forgery (ssrf) vulnerability in imagestreamimport mechanismEPSS 0.3%CVE-2025-61768MEDIUMKuno CMS Vulnerable to Server-Side Request Forgery (SSRF) via Unsafe SVG UploadEPSS 0.3%CVE-2025-52455MEDIUMServer-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server on Windows, Linux (EPS Server modules) allows Resource LocatioEPSS 0.3%CVE-2025-53371CRITICALDiscordNotifications allows DOS, SSRF, and possible RCE through requests to user-controlled URLsEPSS 0.3%CVE-2026-63096MEDIUMDendrite 0.13.8 SSRF via Unauthenticated Legacy Media Download EndpointEPSS 0.3%CVE-2024-1568MEDIUMSeraphinite Accelerator <= 2.20.52 - Authenticated (Subscriber+) Server-Side Request Forgery in OnAdminApi_HtmlCheckEPSS 0.3%CVE-2026-44971HIGHGuardDog: Blind GitHub URL rewrite in remote project scanning causes SSRF and `GH_TOKEN` exfiltrationEPSS 0.3%CVE-2026-77267HIGHmcp-atlassian has an incomplete SSRF remediationEPSS 0.3%CVE-2023-39301MEDIUMQTS, QuTS hero, QuTScloudEPSS 0.3%CVE-2026-62226MEDIUMOpenClaw 2026.3.28 < 2026.5.19 Authorization Bypass via Browser Act RouteEPSS 0.3%CVE-2026-63311MEDIUMNLTK before 3.10.0 SSRF via DNS Resolution FailureEPSS 0.3%CVE-2024-24888MEDIUMWordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.2.25 - Server Side Request Forgery (SSRF) vulnerabilityEPSS 0.3%CVE-2026-62197MEDIUMOpenClaw < 2026.6.6 Policy Bypass via CDP DiscoveryEPSS 0.3%CVE-2025-13809MEDIUMorionsec orion-ops SSH Connection MachineInfoController.java server-side request forgeryEPSS 0.3%CVE-2026-35548HIGHAn issue was discovered in guardsix (formerly Logpoint) ODBC Enrichment Plugins before 5.2.1 (5.2.1 is used in guardsix 7.9.0.0). A logic flEPSS 0.3%CVE-2026-82243HIGHBudibase Server before 3.41.3 SSRF with Credential LeakageEPSS 0.3%