Glossary

SSRF (Server-Side Request Forgery)

SSRF is an attack where an attacker tricks a server into making an HTTP request to an arbitrary address on its behalf. The server "proxies" the request — giving the attacker access to resources unreachable from outside: internal services, cloud metadata endpoints, the local network.

Example

An application loads images from a user-supplied URL: fetch_image?url=http://.... The attacker passes url=http://169.254.169.254/latest/meta-data/ — the AWS metadata endpoint. The server fetches IAM tokens and returns them.

Defence

Whitelist of allowed domains — do not trust arbitrary user-supplied URLs
Block requests to private IPs: 127.0.0.1, 10.x, 172.16-31.x, 192.168.x, 169.254.x
Validate the IP after DNS resolution — DNS rebinding bypasses hostname checks
IMDSv2 on AWS — token-based access to metadata