Falhas do tipo CWE-918

3.076 resultados

Falsificação de Solicitação do Lado do Servidor (SSRF)

O servidor web recebe uma URL de um cliente e a recupera sem validar adequadamente o destino, permitindo que um atacante redirecione requisições para hosts internos, serviços privados ou IPs arbitrários. O risco é grave: exposição de dados internos, acesso a serviços administrativos, varredura de rede interna e até execução de código em sistemas conectados.

Exemplo

Uma aplicação oferece um recurso de 'baixar imagem de URL': o usuário envia `https://attacker.com/fetch?url=http://localhost:8080/admin`, e o servidor, sem validar, faz a requisição e retorna o conteúdo da página admin interna ou de um banco de dados local exposto.

Como mitigar

Valide e liste explicitamente domínios/IPs permitidos (whitelist), bloqueie ranges de IPs privados (10.0.0.0/8, 127.0.0.0/8, 169.254.0.0/16, 172.16.0.0/12, 192.168.0.0/16), use esquemas de URL permitidos (apenas http/https) e desabilite redirects automáticos ou validar o destino final. Considere usar um proxy ou gateway isolado para requisições externas.

CVE-2024-3448MEDIUMImproper Access Control Leads to Server-Side Request Forgery in MauticEPSS 0.4%CVE-2026-62643HIGHIn Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages maEPSS 0.4%CVE-2025-47293LOWPowSyBl Core XML Reader allows XXE and SSRFEPSS 0.4%CVE-2026-3961MEDIUMzyddnys manga-image-translator Translate Endpoints request_extraction.py to_pil_image server-side request forgeryEPSS 0.4%CVE-2026-19927MEDIUMOpenBoxes Product Upload Endpoint ProductController.groovy upload server-side request forgeryEPSS 0.4%CVE-2026-59823MEDIUMLiteLLM: Server-side request forgery via the `user_config` request parameter in LiteLLM ProxyEPSS 0.4%CVE-2026-52776HIGHTrestle URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0EPSS 0.4%CVE-2024-57767HIGHMSFM before v2025.01.01 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /file/download.EPSS 0.4%CVE-2026-34881MEDIUMOpenStack Glance before 29.1.1, 30.x before 30.1.1, and 31.0.0 is affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, EPSS 0.4%CVE-2025-7787MEDIUMXuxueli xxl-job SampleXxlJob.java httpJobHandler server-side request forgeryEPSS 0.4%CVE-2025-52967MEDIUMgateway_proxy_handler in MLflow before 3.1.0 lacks gateway_path validation.EPSS 0.4%CVE-2026-5205MEDIUMchatwoot Webhook API trigger.rb Trigger server-side request forgeryEPSS 0.4%CVE-2026-77646HIGHServer Side Request Forgery (SSRF) vulnerability reported in WindchillEPSS 0.4%CVE-2018-17450MEDIUMAn issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is SEPSS 0.4%CVE-2026-41644HIGHmonetr is vulnerable to server-side request forgery in Lunch Flow link creation and refreshEPSS 0.4%CVE-2026-61520MEDIUMSimple Machines Forum SSRF via image proxyEPSS 0.4%CVE-2026-34428HIGHVvveb < 1.0.8.1 SSRF via oEmbedProxyEPSS 0.4%CVE-2026-59806MEDIUMGradio < 6.20.0 - Open Redirect and SSRF via /gradio_api/file= endpointEPSS 0.4%CVE-2026-54660HIGHswagger-typescript-api vulnerable to authorization-token exfiltration via spec `$ref`EPSS 0.4%CVE-2026-42353HIGHPath traversal / SSRF in i18next-http-middleware via user-controlled language and namespace parametersEPSS 0.4%