Server-side vulnerabilities | #4 Server-Side Request Forgery

Server-Side Request Forgery (SSRF) is a critical web security vulnerability that allows an attacker to manipulate a server-side application into making unauthorized HTTP requests to unintended destinations. This can lead to access to internal systems, sensitive data, or even full server compromise.

In SSRF attacks, the attacker controls the request’s target URL, often exploiting functionality designed to fetch remote resources, such as APIs or image URLs.

Let’s break it down with an example:
Imagine an application allows users to check product stock in stores by sending a request to a back-end API. A typical user request might look like:

Here, the application makes a server-side request to the provided URL (http://api.store.com/...). The server fetches the data and sends it back to the user.

An attacker, however, can exploit this by providing a malicious URL:

If the application does not validate the stockApi parameter, it will send the request to http://localhost/admin. This might bypass access controls, granting the attacker unauthorized access to the admin interface or sensitive information.