SSRFServer-Side Request Forgery
Definition
Vulnerability where an attacker tricks the server into issuing HTTP requests to attacker-chosen targets. Allows reaching cloud metadata, internal networks, and localhost services.
Classic pattern: input that looks like an external URL (webhook URL, image proxy, PDF generator) → server fetches without validating the target → attacker points it at `http://169.254.169.254/latest/meta-data/iam/security-credentials/` (AWS metadata) → steals the role's temporary credentials → pivots.
High-payout in bug bounty when: metadata chains (Capital One 2019), bypass of IP allowlists (DNS rebinding, redirect, decimal IP, IPv6 mapped), internal admin access via localhost.
Defence: strict destination allowlist (not blocklist), block private + link-local + equivalent IPv6, validate after DNS resolution, IMDSv2 on AWS, network segmentation.