Falhas do tipo CWE-918

3.580 resultados

Falsificação de Solicitação do Lado do Servidor (SSRF)

O servidor web recebe uma URL de um cliente e a recupera sem validar adequadamente o destino, permitindo que um atacante redirecione requisições para hosts internos, serviços privados ou IPs arbitrários. O risco é grave: exposição de dados internos, acesso a serviços administrativos, varredura de rede interna e até execução de código em sistemas conectados.

Exemplo

Uma aplicação oferece um recurso de 'baixar imagem de URL': o usuário envia `https://attacker.com/fetch?url=http://localhost:8080/admin`, e o servidor, sem validar, faz a requisição e retorna o conteúdo da página admin interna ou de um banco de dados local exposto.

Como mitigar

Valide e liste explicitamente domínios/IPs permitidos (whitelist), bloqueie ranges de IPs privados (10.0.0.0/8, 127.0.0.0/8, 169.254.0.0/16, 172.16.0.0/12, 192.168.0.0/16), use esquemas de URL permitidos (apenas http/https) e desabilite redirects automáticos ou validar o destino final. Considere usar um proxy ou gateway isolado para requisições externas.

CVE-2026-116205MEDIUMYesWiki before 4.7.0 Unauthenticated SSRF via [[|URL]] Raw-Inclusion SyntaxEPSS 0.5%CVE-2024-31215MEDIUMMobile Security Framework (MobSF) vulnerable to Server-Side Request Forgery (SSRF) in firebase database checkEPSS 0.5%CVE-2026-76086HIGHFormie: Integration form-settings action allows SSRF and exfiltration of stored integration credentialsEPSS 0.5%CVE-2026-108770MEDIUMAppwrite Browser Screenshot Service Get.php PublicHostname server-side request forgeryEPSS 0.5%CVE-2025-0480MEDIUMwuzhicms config.php test server-side request forgeryEPSS 0.5%CVE-2025-5186MEDIUMthinkgem JeeSite URI Scheme form ResourceLoader.getResource server-side request forgeryEPSS 0.5%CVE-2023-5122MEDIUMSSRF in CSV Datasource PluginEPSS 0.5%CVE-2025-13096HIGHXML eXternal Entity injection (XXE) vulnerability affect IBM Business Automation Workflow -EPSS 0.5%CVE-2026-55525HIGHPraisonAI: SSRF via redirect-following in praisonaiagents web_crawlEPSS 0.5%CVE-2026-76728HIGHAuthenticated Server-Side Request Forgery Leading to Remote Code Execution in HPE Networking Instant ON APsEPSS 0.5%CVE-2026-113728HIGHBulwark Webmail: DNS-rebinding SSRF in public iCalendar fetch endpointEPSS 0.5%CVE-2026-85673HIGHLLaMA-Factory SSRF Guard Bypass via Redirect and DNS RebindingEPSS 0.5%CVE-2026-91081MEDIUMDocs through 5.6.1 SSRF via Unauthenticated cors-proxy EndpointEPSS 0.5%CVE-2026-53727HIGHcss_parser: SSRF and Local File Disclosure in `CssParser::Parser#read_remote_file`EPSS 0.5%CVE-2026-67346HIGHSwarms 6.8.1 Server-Side Request Forgery via DNS Rebinding BypassEPSS 0.5%CVE-2024-12867HIGHServer-Side Request Forgery in Arctic Hub URL Mapper allows an unauthenticated remote attacker to exfiltrate and modify configurations and dataEPSS 0.5%CVE-2025-63551HIGHA Server-Side Request Forgery (SSRF) vulnerability, achievable through an XML External Entity (XXE) injection, exists in MetInfo Content ManEPSS 0.5%CVE-2023-38515MEDIUMWordPress Church Admin Plugin <= 3.7.56 is vulnerable to Server Side Request Forgery (SSRF)EPSS 0.5%CVE-2026-59101MEDIUMAutoBangumi < 3.2.8 - SSRF via /api/v1/setup/test-downloaderEPSS 0.5%CVE-2024-23500HIGHWordPress Kadence Blocks plugin <= 3.2.19 - Server Side Request Forgery (SSRF) vulnerabilityEPSS 0.5%