SSRF
acronymsecuritycloudweb dev
Server-Side Request Forgery: tricking a server into making requests on the attacker's behalf - reaching internal addresses the attacker never could directly.
The technique behind the 2019 Capital One breach: one forged request to the metadata service, credentials out.
Server-side request forgery turns a server into a confused deputy. The application accepts a URL, fetches it for a legitimate reason such as rendering a preview or importing a resource, and an attacker supplies a URL pointing somewhere the application was never meant to reach. Because the request originates from the server, it arrives from a trusted position inside the network.
Cloud environments made this substantially worse. Instance metadata services live at a well-known internal address and hand out credentials to anything that asks from the right place, so a successful SSRF against a cloud workload can escalate from an odd HTTP fetch to valid API credentials in a single step. That is why metadata endpoints acquired their own hardening.
Defence is harder than it looks because blocklists lose. Decimal and hexadecimal IP encodings, redirects to an internal address after an external fetch, DNS names that resolve to loopback, and IPv6 representations all defeat naive filtering. Allowlisting destinations is the defence that survives contact with a determined attacker; classifying a URL before fetching it is the operational version of that principle.