Falhas do tipo CWE-918

3.099 resultados

Falsificação de Solicitação do Lado do Servidor (SSRF)

O servidor web recebe uma URL de um cliente e a recupera sem validar adequadamente o destino, permitindo que um atacante redirecione requisições para hosts internos, serviços privados ou IPs arbitrários. O risco é grave: exposição de dados internos, acesso a serviços administrativos, varredura de rede interna e até execução de código em sistemas conectados.

Exemplo

Uma aplicação oferece um recurso de 'baixar imagem de URL': o usuário envia `https://attacker.com/fetch?url=http://localhost:8080/admin`, e o servidor, sem validar, faz a requisição e retorna o conteúdo da página admin interna ou de um banco de dados local exposto.

Como mitigar

Valide e liste explicitamente domínios/IPs permitidos (whitelist), bloqueie ranges de IPs privados (10.0.0.0/8, 127.0.0.0/8, 169.254.0.0/16, 172.16.0.0/12, 192.168.0.0/16), use esquemas de URL permitidos (apenas http/https) e desabilite redirects automáticos ou validar o destino final. Considere usar um proxy ou gateway isolado para requisições externas.

CVE-2026-71280HIGHgo-shiori Server-Side Request Forgery via Unrestricted Bookmark URL FetchEPSS 0.3%CVE-2026-82246HIGHBudibase Server before 3.41.3 SSRF via Query ImportEPSS 0.3%CVE-2025-11361MEDIUMEssential Blocks <= 5.7.1 - Authenticated (Author+) Server-Side Request ForgeryEPSS 0.3%CVE-2025-9414MEDIUMkalcaddle kodbox Download from Link serverDownload server-side request forgeryEPSS 0.3%CVE-2025-10695MEDIUMOpenSupports 4.11.0 — SSRF via test imap and smtp endpointsEPSS 0.3%CVE-2026-95930MEDIUMiFlytek astron-agent debugToolV2 API endpoint UrlCheckTool.checkUrl server-side request forgeryEPSS 0.3%CVE-2026-77522MEDIUMMaxKB: Authenticated full-read SSRF via the knowledge web-document import/sync crawler (Fork.fork requests.get, no internal-IP guard, non-blind)EPSS 0.3%CVE-2024-22329MEDIUMIBM WebSphere Application Server server-side request forgeryEPSS 0.3%CVE-2026-76559MEDIUMWP Import Export Lite < 3.9.33 - Admin+ SSRF via Import URL HandlingEPSS 0.3%CVE-2025-30680HIGHA Server-side Request Forgery (SSRF) vulnerability in Trend Micro Apex Central (SaaS) could allow an attacker to manipulate certain parameteEPSS 0.3%CVE-2026-83543MEDIUMGreenshift < 13.2.0 - Contributor+ SSRF via get-csv-to-json REST EndpointEPSS 0.3%CVE-2026-33644LOWLychee has SSRF bypass via DNS rebinding — PhotoUrlRule only validates IP addresses, not hostnames resolving to internal IPsEPSS 0.3%CVE-2026-76361LOWServer-Side Request Forgery (SSRF) through the Connectivity Check REST API in Splunk SOAREPSS 0.3%CVE-2026-42860HIGHOpen edx Enterprise Service: SSRF via SAML metadata URL in sync_provider_data endpointEPSS 0.3%CVE-2026-33537MEDIUMLychee has SSRF bypass via incomplete IP validation in Photo::fromUrl — loopback and link-local IPs not blockedEPSS 0.3%CVE-2025-1043MEDIUMEmbed Any Document – Embed PDF, Word, PowerPoint and Excel Files <= 2.7.5 - Authenticated (Contributor+) Blind Server-Side Request Forgery via embeddoc ShortcodeEPSS 0.3%CVE-2024-34711CRITICALGeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF)EPSS 0.3%CVE-2026-33060MEDIUMCKAN MCP Server: SSRF via base_url allows access to internal networksEPSS 0.3%CVE-2026-55591MEDIUMSignal K Server: Server-Side Request Forgery via Remote Connection EndpointsEPSS 0.3%CVE-2026-101005MEDIUMOctober CMS SSRF Protection ResizeImages.php validateExternalImageHost server-side request forgeryEPSS 0.3%