SSRF allows attackers to coerce backend systems into making requests to internal or privileged network locations. In API architectures, this often occurs in URL fetchers, webhooks, import features, and metadata resolvers. Successful SSRF can expose internal services, cloud metadata, and hidden control planes.
Enforce strict outbound destination allowlists, normalize and validate URLs, and block private/internal address ranges. Isolate metadata services and apply egress controls at network boundaries. Log and alert on unusual outbound patterns, especially requests to internal address space.
The same feature written the risky way, then with the fix applied.
How this risk has ranked in each OWASP release.
2023Latest
#07api07-2023 Server Side Request Forgery
