In OWASP 2021, A10 Server-Side Request Forgery (SSRF) combines related risk themes across Server-Side Request Forgery (SSRF). SSRF occurs when an application fetches a user-influenced URL or network resource without tightly constraining where that request can go. Attackers abuse this behavior to probe internal services, access cloud metadata endpoints, reach management interfaces that are not internet-facing, or pivot into other protocols and trust zones that the external attacker could not contact directly. The danger is amplified when the server has broad network reach, follows redirects automatically, resolves hostnames dynamically, or returns full upstream responses to the attacker. Operationally, SSRF can convert a seemingly small URL-fetching feature into a network reconnaissance and credential theft primitive with impact far beyond the original application boundary.
For OWASP 2021 A10 Server-Side Request Forgery (SSRF), apply defense in depth across design, implementation, deployment, and operations rather than relying on a single control. Priority controls include: Restrict outbound requests with allowlists of approved destinations, block private and link-local address ranges, and isolate metadata and control-plane services behind network protections that application workloads cannot reach by default. Canonically parse and validate URLs before use, disable unnecessary redirect following, constrain supported protocols and ports, and enforce strict timeouts, size limits, and response handling so fetch features cannot be repurposed as general-purpose proxies. Where remote retrieval is required, route it through hardened egress services or brokers that apply policy centrally and log destination details for review. Treat mitigation as a continuous program: test SSRF scenarios in threat models and security reviews, monitor outbound connection patterns, and revisit egress controls whenever new infrastructure or third-party integrations are introduced.
The same feature written the risky way, then with the fix applied.
How this risk has ranked in each OWASP release.
2021Latest
#10A10 Server-Side Request Forgery (SSRF)
