Falhas do tipo CWE-918

3.105 resultados

Falsificação de Solicitação do Lado do Servidor (SSRF)

O servidor web recebe uma URL de um cliente e a recupera sem validar adequadamente o destino, permitindo que um atacante redirecione requisições para hosts internos, serviços privados ou IPs arbitrários. O risco é grave: exposição de dados internos, acesso a serviços administrativos, varredura de rede interna e até execução de código em sistemas conectados.

Exemplo

Uma aplicação oferece um recurso de 'baixar imagem de URL': o usuário envia `https://attacker.com/fetch?url=http://localhost:8080/admin`, e o servidor, sem validar, faz a requisição e retorna o conteúdo da página admin interna ou de um banco de dados local exposto.

Como mitigar

Valide e liste explicitamente domínios/IPs permitidos (whitelist), bloqueie ranges de IPs privados (10.0.0.0/8, 127.0.0.0/8, 169.254.0.0/16, 172.16.0.0/12, 192.168.0.0/16), use esquemas de URL permitidos (apenas http/https) e desabilite redirects automáticos ou validar o destino final. Considere usar um proxy ou gateway isolado para requisições externas.

CVE-2026-36469CRITICALCuteNews v.2.1.2 is vulnerable to Server-Side Request Forgery (SSRF) in core/modules/media.php -- upload_from_inet (Media Manager's "Upload EPSS 0.3%CVE-2025-67961MEDIUMWordPress WPO365 plugin <= 40.0 - Server Side Request Forgery (SSRF) vulnerabilityEPSS 0.3%CVE-2024-46413MEDIUMRebuild v3.7.7 was discovered to contain a Server-Side Request Forgery (SSRF) via the type parameter in the com.rebuild.web.admin.rbstore.RBEPSS 0.3%CVE-2026-48707LOWInstantCMS vulnerable to SSRF via upload redirect bypass allows internal network service scanningEPSS 0.3%CVE-2026-29107MEDIUMSuiteCRM vulnerable to authenticated SSRF via PDF exportEPSS 0.3%CVE-2025-32358MEDIUMIn Zammad 6.4.x before 6.4.2, SSRF can occur. Authenticated admin users can enable webhooks in Zammad, which are triggered as POST requests EPSS 0.3%CVE-2026-59278MEDIUMIn Spring for Apache Kafka, SSRF via DNS resolution triggered by untrusted java.net types in header mapper default trusted packagesEPSS 0.3%CVE-2026-77261HIGHMCP Atlassian: SSRF redirect protection missing for basic-auth and OAuth authentication branchesEPSS 0.3%CVE-2025-15613MEDIUMKyverno before v1.13.4 SSRF via Service CallEPSS 0.3%CVE-2026-84761HIGHWordPress LiteSpeed Cache plugin <= 7.9 - Server Side Request Forgery (SSRF) vulnerabilityEPSS 0.3%CVE-2026-32473HIGHWordPress PDF Smart Viewer for Elementor plugin <= 1.0.4 - Server Side Request Forgery (SSRF) vulnerabilityEPSS 0.3%CVE-2026-32553HIGHWordPress OttoKit plugin <= 1.1.35 - Server Side Request Forgery (SSRF) vulnerabilityEPSS 0.3%CVE-2026-77581HIGHBentoPDF: SSRF in cors-proxy-worker.js via DNS-based hostname allowlist bypassEPSS 0.3%CVE-2026-65516HIGHWordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Server Side Request Forgery (SSRF) vulnerabilityEPSS 0.3%CVE-2026-81806HIGHWordPress Hide My WP Ghost plugin <= 7.0.09 - Server Side Request Forgery (SSRF) vulnerabilityEPSS 0.3%CVE-2026-57372HIGHWordPress WPJAM Basic plugin <= 7.0 - Server Side Request Forgery (SSRF) vulnerabilityEPSS 0.3%CVE-2026-57407HIGHWordPress PDF Generator for WordPress plugin <= 1.6.2 - Server Side Request Forgery (SSRF) vulnerabilityEPSS 0.3%CVE-2026-66704HIGHWordPress Gutenverse Companion plugin <= 2.5.1 - Server Side Request Forgery (SSRF) vulnerabilityEPSS 0.3%CVE-2026-57348HIGHWordPress Paid Member Subscriptions plugin <= 3.0.4 - Server Side Request Forgery (SSRF) vulnerabilityEPSS 0.3%CVE-2026-59552HIGHWordPress 3D Flipbook PDF Viewer & Embedder plugin <= 1.4.2 - Server Side Request Forgery (SSRF) vulnerabilityEPSS 0.3%