Falhas do tipo CWE-918

3.044 resultados

Falsificação de Solicitação do Lado do Servidor (SSRF)

O servidor web recebe uma URL de um cliente e a recupera sem validar adequadamente o destino, permitindo que um atacante redirecione requisições para hosts internos, serviços privados ou IPs arbitrários. O risco é grave: exposição de dados internos, acesso a serviços administrativos, varredura de rede interna e até execução de código em sistemas conectados.

Exemplo

Uma aplicação oferece um recurso de 'baixar imagem de URL': o usuário envia `https://attacker.com/fetch?url=http://localhost:8080/admin`, e o servidor, sem validar, faz a requisição e retorna o conteúdo da página admin interna ou de um banco de dados local exposto.

Como mitigar

Valide e liste explicitamente domínios/IPs permitidos (whitelist), bloqueie ranges de IPs privados (10.0.0.0/8, 127.0.0.0/8, 169.254.0.0/16, 172.16.0.0/12, 192.168.0.0/16), use esquemas de URL permitidos (apenas http/https) e desabilite redirects automáticos ou validar o destino final. Considere usar um proxy ou gateway isolado para requisições externas.

CVE-2021-34811MEDIUMServer-Side Request Forgery (SSRF) vulnerability in task management component in Synology Download Station before 3.8.16-3566 allows remote EPSS 0.8%CVE-2023-40017HIGHGeonode Server Side Request Forgery vulnerabilityEPSS 0.8%CVE-2023-6852MEDIUMkalcaddle KodExplorer app.php server-side request forgeryEPSS 0.8%CVE-2022-22993HIGHLimited Server-Side Request Forgery vulnerability on Western Digital My Cloud devices.EPSS 0.8%CVE-2026-45741HIGHGotenberg: SSRF deny-list bypass in IsPublicIP via IPv6 6to4 / NAT64 / site-local prefixesEPSS 0.8%CVE-2024-12882HIGHSSRF in comfyanonymous/comfyuiEPSS 0.8%CVE-2026-26222CRITICALDocLink .NET Remoting Unauthenticated Arbitrary File Read/Write RCEEPSS 0.8%CVE-2022-4335MEDIUMA blind SSRF vulnerability was identified in all versions of GitLab EE prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 whichEPSS 0.8%CVE-2024-36471HIGHApache Allura: sensitive information exposure via DNS rebindingEPSS 0.8%CVE-2024-49521HIGHAdobe Commerce | Server-Side Request Forgery (SSRF) (CWE-918)EPSS 0.7%CVE-2024-12376HIGHServer Side Request Forgery in lm-sys/fastchatEPSS 0.7%CVE-2024-12766HIGHSSRF in parisneo/lollms-webuiEPSS 0.7%CVE-2023-1634MEDIUMOTCMS URL Parameter info_deal.php UseCurl server-side request forgeryEPSS 0.7%CVE-2025-34231HIGHVasion Print (formerly PrinterLogic) SSRF via HP badgeSetup.phpEPSS 0.7%CVE-2025-57644CRITICALAccela Automation Platform 22.2.3.0.230103 contains multiple vulnerabilities in the Test Script feature. An authenticated administrative useEPSS 0.7%CVE-2022-28217—Some part of SAP NetWeaver (EP Web Page Composer) does not sufficiently validate an XML document accepted from an untrusted source, which alEPSS 0.7%CVE-2022-38212HIGHServer Side Request Forgery (SSRF) vulnerability in Portal for ArcGIS (10.8.1 and 10.7.1 only)EPSS 0.7%CVE-2022-38203HIGHThe allowedProxyHosts property is not fully honored in ArcGIS Enterprise (10.8.1 and 10.7.1 only)EPSS 0.7%CVE-2023-37290HIGHInfoDoc Document On-line Submission and Approval System - Server-Side Request Forgery (SSRF)EPSS 0.7%CVE-2023-3238MEDIUMOTCMS server-side request forgeryEPSS 0.7%