Server-Side Request Forgery (SSRF)
CWE-918: Server-Side Request Forgery (SSRF)
Server-side request forgery happens when an application fetches a URL or connects to a host that the user controls, without restricting the destination. The attacker uses the server as a proxy to reach places they cannot reach directly, such as internal admin services, databases, or cloud instance metadata endpoints that hand out credentials. Redirects, DNS rebinding, and alternative IP encodings are common ways around naive filters.
Ranks change between editions as the underlying CVE data changes, so exam questions rarely hinge on an exact rank. Know what each weakness is, how it is exploited, and how it is prevented.
How it shows up in the real world
- A link preview feature fetches http://169.254.169.254/ and returns cloud instance metadata, including temporary access keys.
- A PDF generator renders attacker HTML that loads an internal-only admin page into the output document.
- A webhook URL validated only by hostname is pointed at a domain that resolves to 127.0.0.1.
How to mitigate it
- Allow-list the destinations a server-side fetcher may reach, by scheme, host, and port.
- Resolve the host name and block private, loopback, and link-local addresses, and re-check after redirects.
- Require IMDSv2-style session tokens for cloud metadata and limit network egress from application servers.
- Never return raw responses from fetched URLs to the user unless the feature genuinely needs it.
Go deeper
Practice this topic
Test your knowledge of Server-Side Request Forgery (SSRF) with exam-style practice questions.