Falhas do tipo CWE-918

3.510 resultados

Falsificação de Solicitação do Lado do Servidor (SSRF)

O servidor web recebe uma URL de um cliente e a recupera sem validar adequadamente o destino, permitindo que um atacante redirecione requisições para hosts internos, serviços privados ou IPs arbitrários. O risco é grave: exposição de dados internos, acesso a serviços administrativos, varredura de rede interna e até execução de código em sistemas conectados.

Exemplo

Uma aplicação oferece um recurso de 'baixar imagem de URL': o usuário envia `https://attacker.com/fetch?url=http://localhost:8080/admin`, e o servidor, sem validar, faz a requisição e retorna o conteúdo da página admin interna ou de um banco de dados local exposto.

Como mitigar

Valide e liste explicitamente domínios/IPs permitidos (whitelist), bloqueie ranges de IPs privados (10.0.0.0/8, 127.0.0.0/8, 169.254.0.0/16, 172.16.0.0/12, 192.168.0.0/16), use esquemas de URL permitidos (apenas http/https) e desabilite redirects automáticos ou validar o destino final. Considere usar um proxy ou gateway isolado para requisições externas.

CVE-2021-33705HIGHThe SAP NetWeaver Portal, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, component Iviews Editor contains a Server-Side Request ForgerEPSS 2.1%CVE-2024-24806HIGHImproper Domain Lookup that potentially leads to SSRF attacks in libuvEPSS 2.0%CVE-2025-47733CRITICALMicrosoft Power Apps Information Disclosure VulnerabilityEPSS 2.0%CVE-2022-23206—Server-Side Request Forgery in Traffic Ops endpoint POST /user/login/oauthEPSS 2.0%CVE-2026-33534MEDIUMEspoCRM has authenticated SSRF via internal-host validation bypass using alternative IPv4 notationEPSS 2.0%CVE-2023-37379—Apache Airflow: Exposure of sensitive connection information, DOS and SSRF on "test connection" featureEPSS 2.0%CVE-2026-40280HIGHGotenberg SSRF via case-insensitive URL scheme bypass in webhook and downloadFrom deny-listsEPSS 1.9%CVE-2026-40175MEDIUMAxios has Unrestricted Cloud Metadata Exfiltration via Header Injection ChainEPSS 1.9%CVE-2021-36043HIGHMagento Commerce Authenticated Blind SSRF Could Lead To Remote Code ExecutionEPSS 1.9%CVE-2026-25545MEDIUMAstro has Full-Read SSRF in error rendering via Host: header injectionEPSS 1.9%CVE-2022-35949MEDIUM`undici.request` vulnerable to SSRF using absolute URL on `pathname`EPSS 1.9%CVE-2025-54249MEDIUMAdobe Experience Manager | Server-Side Request Forgery (SSRF) (CWE-918)EPSS 1.9%CVE-2024-55875CRITICALhttp4k has a potential XXE (XML External Entity Injection) vulnerabilityEPSS 1.9%CVE-2022-24969—bypass of CVE-2021-25640EPSS 1.9%CVE-2020-15152CRITICALServer-Side Request Forgery in ftp-srvEPSS 1.9%CVE-2022-2339CRITICALServer-Side Request Forgery (SSRF) in nocodb/nocodbEPSS 1.9%CVE-2024-38109CRITICALAzure Health Bot Elevation of Privilege VulnerabilityEPSS 1.8%CVE-2026-54157CRITICALLobeHub: Unauthenticated SSRF in `/webapi/proxy`EPSS 1.8%CVE-2025-34282MEDIUMThingsBoard < v4.2.1 SVG Image SSRFEPSS 1.8%CVE-2022-1767HIGHServer-Side Request Forgery (SSRF) in jgraph/drawioEPSS 1.8%