Falhas do tipo CWE-918

3.090 resultados

Falsificação de Solicitação do Lado do Servidor (SSRF)

O servidor web recebe uma URL de um cliente e a recupera sem validar adequadamente o destino, permitindo que um atacante redirecione requisições para hosts internos, serviços privados ou IPs arbitrários. O risco é grave: exposição de dados internos, acesso a serviços administrativos, varredura de rede interna e até execução de código em sistemas conectados.

Exemplo

Uma aplicação oferece um recurso de 'baixar imagem de URL': o usuário envia `https://attacker.com/fetch?url=http://localhost:8080/admin`, e o servidor, sem validar, faz a requisição e retorna o conteúdo da página admin interna ou de um banco de dados local exposto.

Como mitigar

Valide e liste explicitamente domínios/IPs permitidos (whitelist), bloqueie ranges de IPs privados (10.0.0.0/8, 127.0.0.0/8, 169.254.0.0/16, 172.16.0.0/12, 192.168.0.0/16), use esquemas de URL permitidos (apenas http/https) e desabilite redirects automáticos ou validar o destino final. Considere usar um proxy ou gateway isolado para requisições externas.

CVE-2025-1912HIGHProduct Import Export for WooCommerce <= 2.5.0 - Authenticated (Administrator+) Server-Side Request Forgery via validate_file FunctionEPSS 0.4%CVE-2026-7657MEDIUMLangflow OSS is affected by server-side request forgery in provider validation and API request functionalityEPSS 0.4%CVE-2025-61784HIGHLLaMA Factory's Chat API has Critical SSRF and LFI VulnerabilitiesEPSS 0.4%CVE-2026-72855HIGHBudibase before 3.40.0 DNS Rebinding SSRF via OpenAPI and RESTEPSS 0.4%CVE-2026-73497MEDIUMMCP Atlassian is a Model Context Protocol (MCP): DNS-rebinding TOCTOU bypass of the SSRF fix (CVE-2026-27826): unauthenticated SSRF to cloud metadataEPSS 0.4%CVE-2026-39965HIGHTypeBot: SSRF via Open Redirect Bypass in HTTP Request and Code BlocksEPSS 0.4%CVE-2026-35032HIGHJellyfin: Potential SSRF + Arbitrary file read via LiveTV M3U tunerEPSS 0.4%CVE-2026-47684HIGHSync-in Server: SSRF protection bypass via IPv4-mapped IPv6 addresses in regExpPrivateIPEPSS 0.4%CVE-2026-56677HIGH9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test EndpointEPSS 0.4%CVE-2026-79717MEDIUMGalaxy_ng: galaxy_ng: blind ssrf via namespace avatar_url with no private-address restrictionEPSS 0.4%CVE-2026-92184MEDIUMag-ui-protocol ag-ui Multimodal Content utils.py urllib.request.urlopen server-side request forgeryEPSS 0.4%CVE-2026-40089CRITICALSonicverse has Server-Side Request Forgery via user-controlled URLs in dashboard API clientEPSS 0.4%CVE-2026-1648HIGHPerformance Monitor <= 1.0.6 - Unauthenticated Server-Side Request Forgery via 'url' ParameterEPSS 0.4%CVE-2026-16222MEDIUM1Panel-dev CordysCRM Third Party Endpoint TokenService.java server-side request forgeryEPSS 0.4%CVE-2025-45474HIGHmaccms10 v2025.1000.4047 is vulnerable to Server-side request forgery (SSRF) in Email Settings.EPSS 0.4%CVE-2026-15628MEDIUMzhayujie chatgpt-on-wechat CowAgent Vision Tool vision.py Vision._download_to_data_url server-side request forgeryEPSS 0.4%CVE-2026-14748MEDIUMAIAnytime Awesome-MCP-Server mcp-wiki/wiki-summary server.py server-side request forgeryEPSS 0.4%CVE-2026-15525MEDIUMkLOsk adloop write.py _validate_urls server-side request forgeryEPSS 0.4%CVE-2026-13540MEDIUMGitBucket RepositoryCreationService.scala Git.cloneRepository.setURI server-side request forgeryEPSS 0.4%CVE-2026-90790MEDIUMa2aproject a2a-python Push Notification Sender base_push_notification_sender.py _dispatch_notification server-side request forgeryEPSS 0.4%