Server-side request forgery (SSRF)
SSRF · server side request forgery · falsification de requête côté serveur
A flaw that lets an attacker make the server itself send requests to addresses of the attacker’s choosing, including internal systems that are normally unreachable from the internet.
In practice
It shows up in features that fetch a resource from a URL supplied by the user: link previews, image imports, webhooks, document conversion. The server, sitting inside the network, becomes the attacker’s relay: it can query internal admin services or the cloud metadata service, which sometimes hands out access keys. A category of its own in the 2021 edition, SSRF now sits under Broken Access Control (A01) in the OWASP Top 10:2025.
In March 2021, the ProxyLogon flaw in Microsoft Exchange servers (CVE-2021-26855) was an SSRF: an unauthenticated attacker could pass themselves off as the server itself. Chained with other flaws, it led to remote code execution on mail servers around the world.
How to protect yourself
- Allow only expected destinations (an allow-list) and build the URL on the server side.
- Disable redirect following and block internal and metadata addresses.
- Use the hardened version of your cloud provider’s metadata service (IMDSv2 on AWS).
- Isolate the component that makes outbound requests in a network with no access to internal systems.
