Server-Side Request Forgery (SSRF)

Server-Side Request Forgery (SSRF) occurs when an attacker tricks a vulnerable server into making unauthorized requests to internal or external resources. This can lead to data exfiltration, internal network scanning, cloud metadata exposure, and service exploitation. SSRF is particularly dangerous when applications allow user-controlled URLs or fail to restrict outgoing requests.

SSRF was a standalone entry (A10) in the OWASP Top 10:2021. The 2025 release consolidates it into A01: Broken Access Control, on the reasoning that SSRF is an access control failure: the application lets an attacker decide which resources the server itself may reach.

Common Vulnerabilities:

• Fetching External URLs Without Proper Validation (e.g., allowing arbitrary URLs in request parameters)
• Accessing Internal Services (e.g., databases, admin panels, cloud metadata APIs)
• SSRF-Based AWS Credentials Theft via the Instance Metadata Service (IMDS)
• Bypassing Network Restrictions to Exploit Internal Systems
• Interacting with Cloud Services (e.g., Kubernetes, Docker APIs) to Gain Unauthorized Access
• Forcing the Application to Perform Malicious Actions on Other Services

To mitigate these risks, applications should validate and restrict user-supplied URLs, enforce allowlists for outgoing requests, block access to internal IP ranges (e.g., 127.0.0.1, 169.254.169.254), and use metadata service version 2 (IMDSv2) in AWS environments. Additionally, logging and monitoring outbound requests can help detect and prevent SSRF exploitation attempts.