Server-Side Request Forgery
High · Injection · OWASP A10:2021 · CWE-918
Description
Server is made to request attacker-chosen URLs.
Root cause
Fetching user-supplied URLs without validation.
Impact
Access to internal services and cloud metadata.
Detection
Outbound request logs to internal ranges/metadata IPs.
Mitigation
Allow-lists, block internal ranges, IMDSv2.
Secure coding
Validate and resolve URLs server-side against an allow-list.
Safe lab example
PortSwigger SSRF labs
Practise related skills in Labs or deepen on Academy library.