Falhas do tipo CWE-918

3.031 resultados

Falsificação de Solicitação do Lado do Servidor (SSRF)

O servidor web recebe uma URL de um cliente e a recupera sem validar adequadamente o destino, permitindo que um atacante redirecione requisições para hosts internos, serviços privados ou IPs arbitrários. O risco é grave: exposição de dados internos, acesso a serviços administrativos, varredura de rede interna e até execução de código em sistemas conectados.

Exemplo

Uma aplicação oferece um recurso de 'baixar imagem de URL': o usuário envia `https://attacker.com/fetch?url=http://localhost:8080/admin`, e o servidor, sem validar, faz a requisição e retorna o conteúdo da página admin interna ou de um banco de dados local exposto.

Como mitigar

Valide e liste explicitamente domínios/IPs permitidos (whitelist), bloqueie ranges de IPs privados (10.0.0.0/8, 127.0.0.0/8, 169.254.0.0/16, 172.16.0.0/12, 192.168.0.0/16), use esquemas de URL permitidos (apenas http/https) e desabilite redirects automáticos ou validar o destino final. Considere usar um proxy ou gateway isolado para requisições externas.

CVE-2023-21761HIGHMicrosoft Exchange Server Information Disclosure VulnerabilityEPSS 1.6%CVE-2022-1379HIGHURL Restriction Bypass in plantuml/plantumlEPSS 1.6%CVE-2025-36845HIGHAn issue was discovered in Eveo URVE Web Manager 27.02.2025. The endpoint /_internal/redirect.php allows for Server-Side Request Forgery (SSEPSS 1.6%CVE-2021-29102CRITICALThere is a Server-Side Request Forgery (SSRF) vulnerability in Esri ArcGIS Server Manager version 10.8.1 and below.EPSS 1.6%CVE-2026-53755HIGHCrawl4AI: SSRF via proxy settings in the Docker server bypasses the crawl-URL SSRF checkEPSS 1.6%CVE-2022-4096HIGHServer-Side Request Forgery (SSRF) in appsmithorg/appsmithEPSS 1.6%CVE-2024-40898CRITICALApache HTTP Server: SSRF with mod_rewrite in server/vhost context on WindowsEPSS 1.5%CVE-2023-6974HIGHServer-Side Request Forgery (SSRF)EPSS 1.5%CVE-2019-1872MEDIUMCisco TelePresence Video Communication Server and Cisco Expressway Series Server-Side Request Forgery VulnerabilityEPSS 1.5%CVE-2026-55229HIGHGotenberg: SSRF via LibreOffice document processingEPSS 1.5%CVE-2022-40357CRITICALA security issue was discovered in Z-BlogPHP <= 1.7.2. A Server-Side Request Forgery (SSRF) vulnerability in the zb_users/plugin/UEditor/phpEPSS 1.5%CVE-2026-45298HIGHDozzle: Pre-auth SSRF with response-body reflection via POST /api/notifications/test-webhook (default no-auth deploy)EPSS 1.5%CVE-2021-22970—Concrete CMS (formerly concrete5) versions 8.5.6 and below and version 9.0.0 allow local IP importing causing the system to be vulnerable toEPSS 1.5%CVE-2024-54330HIGHWordPress Hurrakify plugin <= 2.4 - Server Side Request Forgery (SSRF) vulnerabilityEPSS 1.5%CVE-2021-32663HIGHUnauthorized setup leads to SSRF in Combodo/iTopEPSS 1.5%CVE-2024-36675CRITICALLyLme_spage v1.9.5 is vulnerable to Server-Side Request Forgery (SSRF) via the get_head function.EPSS 1.4%CVE-2021-36396HIGHIn Moodle, insufficient redirect handling made it possible to blindly bypass cURL blocked hosts/allowed ports restrictions, resulting in a bEPSS 1.4%CVE-2017-11148—Server-side request forgery (SSRF) vulnerability in link preview in Synology Chat before 1.1.0-0806 allows remote authenticated users to accEPSS 1.4%CVE-2022-1239—HubSpot < 8.8.15 - Contributor+ Blind SSRFEPSS 1.4%CVE-2022-21215CRITICALAirspan Networks Mimosa Server-Side Request Forgery (SSRF)EPSS 1.4%