Definition
Server-side request forgery occurs when an application can be induced to make a network request to a destination the requester controls or influences. The weakness is in who chooses the destination, not in the request itself.
Why the destination changes everything
An application that fetches an arbitrary external URL is a problem. An application that can be pointed at an internal address is a different problem. Cloud environments commonly expose an instance metadata service reachable only from inside the host, and that service can return configuration and credential material intended for the workload itself.
So the finding should not stop at "the application made an unexpected HTTP request." The question is what became reachable as a result: an internal service, a metadata endpoint, a credential, and whatever that credential unlocks next.
Where it usually appears
- URL preview and link-unfurling features
- Document, image and feed importers
- Webhook processors and outbound callbacks
- PDF and thumbnail renderers
- Any parameter that accepts a URL, hostname or file location
- Internet
- Application
- Internal Request
- Credential
- Cloud Resource
Each hop validated by successful exploitation
Tags
- ssrf
- cloud
- credentials