What Is Server-Side Request Forgery (SSRF)?
Server-side request forgery (SSRF) is a vulnerability where an attacker makes a server send requests to a destination of the attacker’s choosing. Because the request originates from the trusted server — often deep inside a network — it can reach internal systems, cloud metadata services, and resources no external attacker could touch directly. The server becomes an unwitting proxy.
How does SSRF work?#
Any feature that fetches a URL on the server’s behalf is a candidate: webhook testers, image loaders from a URL, PDF generators, link previews. If the user controls the destination and the app does not restrict it:
User supplies: http://169.254.169.254/latest/meta-data/iam/security-credentials/
Server fetches it from inside the cloud →
returns temporary credentials to the attackerThe attacker never reaches the internal endpoint themselves — they borrow the server’s network position and trust, the same theme as its browser-side cousin CSRF, but server-side and far more powerful.
Why is cloud metadata the crown jewel?#
| Target reachable via SSRF | Impact |
|---|---|
| Cloud metadata endpoint | Steal instance credentials, take over the account |
| Internal admin panels | Reach services with no external auth |
| Internal port scanning | Map the private network |
file:// or other schemes | Read local files, depending on the client |
How do you defend against SSRF?#
Defense is defense in depth, because blocklists of “bad” addresses are easily bypassed with redirects, DNS tricks, and alternate IP encodings:
- Allowlist destinations — permit only the specific hosts the feature needs.
- Block internal ranges — deny link-local, private, and loopback addresses (and re-check after redirects).
- Disable unneeded URL schemes — allow
httpsonly. - Use IMDSv2 / metadata protections in the cloud so metadata requires a token.
SSRF is an access-control failure at the network layer. It pairs with broken access control. More at the Web Security hub.
Frequently asked questions#
What is server-side request forgery?
SSRF is a vulnerability where an attacker induces a server to make HTTP or other requests to a destination the attacker chooses. Because the request comes from the trusted server, it can reach internal services, cloud metadata endpoints, and other resources that are unreachable from the outside — turning the server into a proxy.
Why is SSRF so dangerous in the cloud?
Cloud platforms expose an internal metadata endpoint (like 169.254.169.254) that returns credentials and configuration to the instance. An SSRF that reaches it can steal those credentials and pivot to the whole cloud account. This is why SSRF rose into the OWASP Top 10 and features in major cloud breaches.