Falhas do tipo CWE-918

3.002 resultados

Falsificação de Solicitação do Lado do Servidor (SSRF)

O servidor web recebe uma URL de um cliente e a recupera sem validar adequadamente o destino, permitindo que um atacante redirecione requisições para hosts internos, serviços privados ou IPs arbitrários. O risco é grave: exposição de dados internos, acesso a serviços administrativos, varredura de rede interna e até execução de código em sistemas conectados.

Exemplo

Uma aplicação oferece um recurso de 'baixar imagem de URL': o usuário envia `https://attacker.com/fetch?url=http://localhost:8080/admin`, e o servidor, sem validar, faz a requisição e retorna o conteúdo da página admin interna ou de um banco de dados local exposto.

Como mitigar

Valide e liste explicitamente domínios/IPs permitidos (whitelist), bloqueie ranges de IPs privados (10.0.0.0/8, 127.0.0.0/8, 169.254.0.0/16, 172.16.0.0/12, 192.168.0.0/16), use esquemas de URL permitidos (apenas http/https) e desabilite redirects automáticos ou validar o destino final. Considere usar um proxy ou gateway isolado para requisições externas.

CVE-2024-11030HIGHSSRF in binary-husky/gpt_academicEPSS 0.7%CVE-2026-34647HIGHAdobe Commerce | Server-Side Request Forgery (SSRF) (CWE-918)EPSS 0.7%CVE-2026-14645MEDIUMNexus Repository 3 - Server-Side Request Forgery (SSRF) via Webhook: Global CapabilityEPSS 0.7%CVE-2023-31219MEDIUMWordPress Download Monitor Plugin <= 4.8.1 is vulnerable to Server Side Request Forgery (SSRF)EPSS 0.7%CVE-2024-56736MEDIUMApache HertzBeat: Server-Side Request Forgery (SSRF) in Api Config OssEPSS 0.7%CVE-2026-65813MEDIUMMicrosoft Exchange Server Elevation of Privilege VulnerabilityEPSS 0.7%CVE-2024-5482HIGHSSRF in add_webpage endpoint in parisneo/lollms-webuiEPSS 0.7%CVE-2025-6851HIGHBroken Link Notifier <= 1.3.0 - Unauthenticated Server-Side Request ForgeryEPSS 0.6%CVE-2024-42352HIGHServer-Side Request Forgery (SSRF) in nuxt-iconEPSS 0.6%CVE-2024-12775MEDIUMSSRF in langgenius/difyEPSS 0.6%CVE-2024-12779MEDIUMSSRF in infiniflow/ragflowEPSS 0.6%CVE-2023-36925HIGHUnauthenticated blind SSRF in SAP Solution Manager (Diagnostics agent)EPSS 0.6%CVE-2023-29010MEDIUMBudiBase Server-Side Request Forgery vulnerabilityEPSS 0.6%CVE-2023-1725CRITICALSSRF in Infoline Project Management SystemEPSS 0.6%CVE-2026-65317CRITICALVerba (goldenverba) Server-Side Request Forgery via /api/connect and Same-Origin Middleware BypassEPSS 0.6%CVE-2023-28824MEDIUMServer-side request forgery vulnerability exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3. A user who can access the affected pEPSS 0.6%CVE-2024-45479CRITICALApache Ranger: SSRF in Edit Service page - Add logic to filter requests to localhostEPSS 0.6%CVE-2023-0574MEDIUMServer-Side Request ForgeryEPSS 0.6%CVE-2023-1971MEDIUMyuan1994 tpAdmin Upload.php remote server-side request forgeryEPSS 0.6%CVE-2024-47049HIGHThe czim/file-handling package before 1.5.0 and 2.x before 2.3.0 (used with PHP Composer) does not properly validate URLs within makeFromUrlEPSS 0.6%