Falhas do tipo CWE-918

3.097 resultados

Falsificação de Solicitação do Lado do Servidor (SSRF)

O servidor web recebe uma URL de um cliente e a recupera sem validar adequadamente o destino, permitindo que um atacante redirecione requisições para hosts internos, serviços privados ou IPs arbitrários. O risco é grave: exposição de dados internos, acesso a serviços administrativos, varredura de rede interna e até execução de código em sistemas conectados.

Exemplo

Uma aplicação oferece um recurso de 'baixar imagem de URL': o usuário envia `https://attacker.com/fetch?url=http://localhost:8080/admin`, e o servidor, sem validar, faz a requisição e retorna o conteúdo da página admin interna ou de um banco de dados local exposto.

Como mitigar

Valide e liste explicitamente domínios/IPs permitidos (whitelist), bloqueie ranges de IPs privados (10.0.0.0/8, 127.0.0.0/8, 169.254.0.0/16, 172.16.0.0/12, 192.168.0.0/16), use esquemas de URL permitidos (apenas http/https) e desabilite redirects automáticos ou validar o destino final. Considere usar um proxy ou gateway isolado para requisições externas.

CVE-2026-25738MEDIUMIndico has Server-Side Request Forgery (SSRF) in multiple placesEPSS 0.3%CVE-2026-43936MEDIUMe107: Server-Side Request Forgery (SSRF) in the remote file fetcherEPSS 0.3%CVE-2026-47879HIGHSpring Cloud Gateway SSRF and native file access with gRPCEPSS 0.3%CVE-2026-48483MEDIUMTypeBot's WhatsApp status forwarding uses unvalidated user-controlled URLs, allowing SSRF from the Typebot serverEPSS 0.3%CVE-2024-9410MEDIUMAda.cx SSRF via Sentry MisconfigurationEPSS 0.3%CVE-2026-77352MEDIUMWallos: Authenticated SSRF via per-user SMTP notification host (low-privilege user)EPSS 0.3%CVE-2025-24701MEDIUMWordPress Chained Quiz Plugin <= 1.3.2.9 - Server Side Request Forgery (SSRF) vulnerabilityEPSS 0.3%CVE-2025-64327MEDIUMThinkDashboard: Blind Server-Side Request Forgery (SSRF) vulnerability in /api/ping EndpointEPSS 0.3%CVE-2026-42449HIGHn8n-MCP: IPv4-mapped IPv6 addresses bypass SSRF protection in validateUrlSync(), enabling full SSRF for SDK embeddersEPSS 0.3%CVE-2026-34590MEDIUMPostiz: SSRF via Webhook Creation Endpoint Missing URL Safety ValidationEPSS 0.3%CVE-2024-31229MEDIUMWordPress Really Simple SSL plugin <= 7.2.3 - Server Side Request Forgery (SSRF) vulnerabilityEPSS 0.3%CVE-2026-40537MEDIUMA server-side request forgery (SSRF) vulnerability in PersonMail API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-7280EPSS 0.3%CVE-2026-53944MEDIUMGhost: Private IP filtering bypass to make server-side requests to internal servicesEPSS 0.3%CVE-2025-2940HIGHNinja Tables – Easy Data Table Builder <= 5.0.18 - Unauthenticated Server-Side Request ForgeryEPSS 0.3%CVE-2025-65836CRITICALPublicCMS V5.202506.b is vulnerable to SSRF. in the chat interface of SimpleAiAdminController.EPSS 0.3%CVE-2026-4874LOWOrg.keycloak.protocol.oidc.grants: org.keycloak.services.managers: keycloak: server-side request forgery via oidc token endpoint manipulationEPSS 0.3%CVE-2026-57947MEDIUMPinpoint - Server-Side Request Forgery via Alarm Webhook RegistrationEPSS 0.3%CVE-2025-71398MEDIUMSurrealDB before 2.2.2 SSRF via HTTP Redirect BypassEPSS 0.3%CVE-2026-38527HIGHA Server-Side Request Forgery (SSRF) in the /settings/webhooks/create component of Webkul Krayin CRM v2.2.x allows attackers to scan internaEPSS 0.3%CVE-2026-45331HIGHOpen WebUI: Full SSRF Vulnerability in the RAG Web Search FeatureEPSS 0.3%