What is Server-Side Request Forgery (SSRF)?

Definition

SSRF

What is Server-Side Request Forgery?

Server-side request forgery tricks a server into making HTTP requests chosen by the attacker. It is used to reach internal services and cloud metadata endpoints that are unreachable from the internet.

A vulnerability that allows an attacker to induce a server to make HTTP requests to arbitrary internal or external destinations on their behalf, bypassing network segmentation and firewall controls. SSRF is particularly dangerous in cloud environments where it can be leveraged to reach instance metadata services and retrieve temporary credentials for full account takeover. It is a common finding in applications that fetch remote URLs, process webhooks, or retrieve content from user-supplied addresses.

Related terms

API Security →

A set of practices and controls designed to protect application programming interfaces (APIs) from unauthorized access, misuse, and attacks.

Remote Code Execution (RCE) →

A critical vulnerability class that allows an attacker to execute arbitrary commands or code on a target system from a remote location, typically without requiring physical access or prior authentication.

Security Misconfiguration →

The most prevalent web application vulnerability class, arising from incorrectly configured cloud services, application frameworks, databases, web servers, or network infrastructure.

Firewall →

A network security control that monitors and filters traffic between networks based on predefined security rules.

Put this into practice

API security testing automation →

See how Penetrify's autonomous AI agents find and validate this class of security issue in your application.