Server-Side Request Forgery (SSRF)
Server-side request forgery (SSRF) is a vulnerability where an attacker tricks a server into making HTTP or network requests to attacker-chosen destinations, reaching internal services, cloud metadata endpoints, or other systems behind the firewall. It occurs when user-supplied URLs are fetched without validation.
Server-side request forgery (SSRF) occurs when an application fetches a URL supplied or influenced by a user, and an attacker abuses that to make the server issue requests it never intended. Because the request originates from inside the trusted network, it can reach internal-only services, admin panels, databases, or cloud instance metadata endpoints (like 169.254.169.254) that are normally unreachable from the outside.
SSRF is dangerous because the server's identity and network position are borrowed by the attacker. In cloud environments it has been used to steal temporary credentials from metadata services. Defenses include validating and allowlisting destination hosts, resolving and re-checking IPs to block internal ranges (and DNS-rebinding), disabling unused URL schemes and redirects, and requiring authentication on internal services rather than trusting network location alone.
Tracked as CWE-918, SSRF was elevated to its own category in the OWASP Top 10 given the rise of cloud and microservice architectures. Scanners flag outbound requests whose destination is derived from untrusted input without a host allowlist.