Server-side request forgery

Server-side request forgery (SSRF) is a type of computer security <a href="/facts/Exploit_(computer_security)/EdlqsRJM">exploit</a> where an attacker abuses the functionality of a server causing it to access or manipulate information in the realm of that server that would otherwise not be directly accessible to the attacker.
Similar to <a href="/facts/Cross-site_request_forgery/RN7XuvsW">cross-site request forgery</a> which utilizes a <a href="/facts/Web_client/2pfyymLs">web client</a>, for example, a web browser, within the domain as a proxy for attacks; an SSRF attack utilizes a vulnerable server within the domain as a <a href="/facts/Proxy_server/ArhwQE74">proxy</a>.
If a parameter of a URL is vulnerable to this attack, it is possible an attacker can devise ways to interact with the server directly (via localhost) or with the backend servers that are not accessible by the external users. An attacker can practically scan the entire network and retrieve sensitive information.

Server-side request forgery open-in-new

Server-side request forgery