What Is an SSRF Vulnerability and Why Do Attackers Love It?

What is an SSRF vulnerability and why do attackers love it?

Server-Side Request Forgery — SSRF — is one of the vulnerabilities that consistently excites security researchers and alarms security teams. It made the OWASP Top 10 list for the first time in 2021, reflecting both how common it has become and how serious the consequences can be. Capital One's 2019 breach, which exposed the data of over 100 million customers, involved an SSRF vulnerability as a key component of the attack chain.

What SSRF actually is

Most web applications need to fetch data from external sources — loading an image from a URL a user provides, retrieving content from a third-party API, generating a preview of a link someone has shared. When the application makes these outbound requests, it does so from the server — from inside your network.

SSRF happens when an attacker can control the destination of those server-side requests. Instead of providing a legitimate external URL, they provide the address of an internal system — your database server, your internal admin panel, your cloud provider's metadata service. The server, operating from a trusted internal position, makes the request and returns the response.

The attacker has effectively used your server as a proxy to reach systems that should be completely inaccessible from the internet.

What attackers can do with SSRF

Internal network reconnaissance is often the first step. By probing internal IP addresses through an SSRF vulnerability, attackers can map your internal network — discovering which services are running, on which ports, and what software versions they use.

Cloud metadata service access is particularly damaging in cloud-hosted applications. AWS, Google Cloud, and Azure all provide a metadata service at a specific internal IP address that returns configuration information, including temporary credentials with significant permissions.

Internal service exploitation allows attackers to interact with internal systems that have no authentication because they were never designed to be internet-facing.

How SSRF gets fixed

The fix requires validating all server-side requests against an allowlist of permitted destinations. Network-level controls that prevent the application server from making requests to internal addresses provide defence in depth.

Yrzo AI tests for SSRF as one of its 44 automated security checks, probing your application's URL-handling features for signs of server-side request forgery vulnerabilities. Starting at £399.