Falhas do tipo CWE-918

3.031 resultados

Falsificação de Solicitação do Lado do Servidor (SSRF)

O servidor web recebe uma URL de um cliente e a recupera sem validar adequadamente o destino, permitindo que um atacante redirecione requisições para hosts internos, serviços privados ou IPs arbitrários. O risco é grave: exposição de dados internos, acesso a serviços administrativos, varredura de rede interna e até execução de código em sistemas conectados.

Exemplo

Uma aplicação oferece um recurso de 'baixar imagem de URL': o usuário envia `https://attacker.com/fetch?url=http://localhost:8080/admin`, e o servidor, sem validar, faz a requisição e retorna o conteúdo da página admin interna ou de um banco de dados local exposto.

Como mitigar

Valide e liste explicitamente domínios/IPs permitidos (whitelist), bloqueie ranges de IPs privados (10.0.0.0/8, 127.0.0.0/8, 169.254.0.0/16, 172.16.0.0/12, 192.168.0.0/16), use esquemas de URL permitidos (apenas http/https) e desabilite redirects automáticos ou validar o destino final. Considere usar um proxy ou gateway isolado para requisições externas.

CVE-2022-1398—External Media without Import <= 1.1.2 - Subscriber+ Blind SSRFEPSS 3.1%CVE-2017-0889—Paperclip ruby gem version 3.1.4 and later suffers from a Server-SIde Request Forgery (SSRF) vulnerability in the Paperclip::UriAdapter clasEPSS 3.1%CVE-2025-22952CRITICALelestio memos v0.23.0 is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of user-supplied URLs, which can beEPSS 2.9%CVE-2024-41570CRITICALAn Unauthenticated Server-Side Request Forgery (SSRF) in demon callback handling in Havoc 2 0.7 allows attackers to send arbitrary network tEPSS 2.9%CVE-2023-36661HIGHShibboleth XMLTooling before 3.2.4, as used in OpenSAML and Shibboleth Service Provider, allows SSRF via a crafted KeyInfo element. (This isEPSS 2.9%CVE-2024-34361HIGHPi-hole Blind Server-Side Request Forgery (SSRF) vulnerability can lead to Remote Code Execution (RCE)EPSS 2.8%CVE-2024-6095MEDIUMSSRF and Partial LFI in /models/apply Endpoint in mudler/localaiEPSS 2.6%CVE-2017-0906—The Recurly Client Python Library before 2.0.5, 2.1.16, 2.2.22, 2.3.1, 2.4.5, 2.5.1, 2.6.2 is vulnerable to a Server-Side Request Forgery vuEPSS 2.6%CVE-2017-0907—The Recurly Client .NET Library before 1.0.1, 1.1.10, 1.2.8, 1.3.2, 1.4.14, 1.5.3, 1.6.2, 1.7.1, 1.8.1 is vulnerable to a Server-Side RequesEPSS 2.6%CVE-2017-0905—The Recurly Client Ruby Library before 2.0.13, 2.1.11, 2.2.5, 2.3.10, 2.4.11, 2.5.4, 2.6.3, 2.7.8, 2.8.2, 2.9.2, 2.10.4, 2.11.3 is vulnerablEPSS 2.6%CVE-2022-38398—Server-Side Request Forgery Information Disclosure VulnerabilityEPSS 2.6%CVE-2021-27738—Improper Access Control to Streaming Coordinator & SSRFEPSS 2.6%CVE-2025-57822MEDIUMNext.js Improper Middleware Redirect Handling Leads to SSRFEPSS 2.5%CVE-2024-28752CRITICALApache CXF SSRF Vulnerability using the Aegis databindingEPSS 2.5%CVE-2024-52606LOWSolarWinds Platform Server-Side Request Forgery VulnerabilityEPSS 2.5%CVE-2022-3172MEDIUMKubernetes - API server - Aggregated API server can cause clients to be redirected (SSRF)EPSS 2.5%CVE-2022-41704HIGHApache Batik prior to 1.16 allows RCE when loading untrusted SVG inputEPSS 2.4%CVE-2022-38648—PDFTranscoder does not block external resourcesEPSS 2.4%CVE-2019-7616—Kibana versions before 6.8.2 and 7.2.1 contain a server side request forgery (SSRF) flaw in the graphite integration for Timelion visualizerEPSS 2.4%CVE-2026-59867HIGHKiota: Generation-time SSRF + remote/local file inclusion via unrestricted $refEPSS 2.4%