Falhas do tipo CWE-918

3.076 resultados

Falsificação de Solicitação do Lado do Servidor (SSRF)

O servidor web recebe uma URL de um cliente e a recupera sem validar adequadamente o destino, permitindo que um atacante redirecione requisições para hosts internos, serviços privados ou IPs arbitrários. O risco é grave: exposição de dados internos, acesso a serviços administrativos, varredura de rede interna e até execução de código em sistemas conectados.

Exemplo

Uma aplicação oferece um recurso de 'baixar imagem de URL': o usuário envia `https://attacker.com/fetch?url=http://localhost:8080/admin`, e o servidor, sem validar, faz a requisição e retorna o conteúdo da página admin interna ou de um banco de dados local exposto.

Como mitigar

Valide e liste explicitamente domínios/IPs permitidos (whitelist), bloqueie ranges de IPs privados (10.0.0.0/8, 127.0.0.0/8, 169.254.0.0/16, 172.16.0.0/12, 192.168.0.0/16), use esquemas de URL permitidos (apenas http/https) e desabilite redirects automáticos ou validar o destino final. Considere usar um proxy ou gateway isolado para requisições externas.

CVE-2026-44023HIGHDocling Core has unsafe remote filename resolutionEPSS 0.4%CVE-2026-19040MEDIUMMissionSquad mcp-api dcrClients.ts server-side request forgeryEPSS 0.4%CVE-2026-73307MEDIUMBudibase: SSRF via bare fetch() in uploadUrl during AI table generationEPSS 0.4%CVE-2026-33480HIGHAVideo has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in Unauthenticated LiveLinks ProxyEPSS 0.4%CVE-2024-4561MEDIUMWhatsUp Gold Server-Side Request Forgery Information Disclosure Vulnerability via FaviconControllerEPSS 0.4%CVE-2026-43884HIGHWWBN AVideo: SSRF Protection Bypass via HTTP Redirect and DNS Rebinding in isSSRFSafeURL()EPSS 0.4%CVE-2026-73530MEDIUMFlyto2 Core < 2.28.0 SSRF Guard Bypass via is_private_ip()EPSS 0.4%CVE-2025-4581MEDIUMLiferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4 ,2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.EPSS 0.4%CVE-2024-9624HIGHWP All Import Pro <= 4.9.3 - Authenticated (Administrator+) Server-Side Request Forgery via File ImportEPSS 0.4%CVE-2024-13195MEDIUMdonglight bookstore电商书城系统说明 HttpUtil.java getHtml server-side request forgeryEPSS 0.4%CVE-2026-91081MEDIUMDocs through 5.6.1 SSRF via Unauthenticated cors-proxy EndpointEPSS 0.4%CVE-2026-61559CRITICAL@zereight/mcp-gitlab Vulnerable to Server-Side Request ForgeryEPSS 0.4%CVE-2026-58442MEDIUMRepository migration SSRF via multi-answer DNS allow-list bypassEPSS 0.4%CVE-2026-41177MEDIUMSquidex has Blind SSRF via file:// Protocol in Restore API leading to Local File InteractionEPSS 0.4%CVE-2024-51242MEDIUMA Server-Side Request Forgery (SSRF) vulnerability has been identified in eladmin 2.7 and earlier in ServerDeployController.java. The manipuEPSS 0.4%CVE-2026-28476MEDIUMOpenClaw < 2026.2.14 - Server-Side Request Forgery in Tlon Extension AuthenticationEPSS 0.4%CVE-2026-44937HIGHSUSE Rancher Fleet had an Unauthenticated Webhook: Regex Injection via Unsanitized Repository URL ComponentsEPSS 0.4%CVE-2026-48555MEDIUMSpatie Laravel Media Library < 11.23.0 SSRF via addMediaFromUrl()EPSS 0.4%CVE-2026-39885HIGHFrontMCP Affected by SSRF via $ref Dereferencing in Untrusted OpenAPI SpecificationsEPSS 0.4%CVE-2025-29461HIGHAn issue in a-blogcms 3.1.15 allows a remote attacker to obtain sensitive information via the /bid/1/admin/entry-edit/ path.EPSS 0.4%