A10: Server-Side Request Forgery (SSRF) · 2021

The server requests an attacker-controlled location that can reach internal services, cloud metadata or destinations blocked for the user.

Summary

The server requests an attacker-controlled location that can reach internal services, cloud metadata or destinations blocked for the user.

How the attack works

The user controls a URL fetched by the server; the request reaches an internal service the user cannot access directly.

Example

Vulnerable · Pseudocode

POST /preview
{"url": "http://internal.example/status"}
preview = fetch(user_url)

Fix: Allow only required destinations; validate resolved IPs and redirects and restrict network egress.

Prevention

Allow only necessary destinations and protocols through an explicit allowlist.
Apply network segmentation and egress controls.
Normalize and validate URLs and block internal ranges and metadata services.

Lineage

2013 · A4: Insecure Direct Object References Merged into Broken Access Control
2013 · A7: Missing Function Level Access Control Merged into Broken Access Control
2017 · A5: Broken Access Control Moves up to rank 1 in 2021
2021 · A01: Broken Access Control Moves up from A5:2017
2021 · A10: Server-Side Request Forgery (SSRF) New in 2021
2025 · A01: Broken Access Control Consolidates SSRF and remains at rank 1

2013:A4 → 2017:A5: IDOR is integrated into Broken Access Control.
2013:A7 → 2017:A5: Missing Function Level Access Control is integrated into Broken Access Control.
2017:A5 → 2021:A01: Broken Access Control moves up from rank 5 to 1.
2021:A01 → 2025:A01: Broken Access Control remains at rank 1.
2021:A10 → 2025:A01: SSRF is consolidated into Broken Access Control.

Sources

Open official source ↗

Buy me a coffee