API7:2023 — Server Side Request Forgery

Slide 2 · Definition

Server Side Request Forgery — when your API fetches what an attacker tells it to.

The server becomes the attacker’s HTTP client. It can reach things the attacker can’t.

One-sentence definition

SSRF occurs when an API accepts a URL from user input and fetches that URL server-side — allowing an attacker to make the server issue requests to internal systems, cloud metadata endpoints, or other destinations the attacker cannot reach directly.

What the developer intended

User provides a URL to import data from an external source

API fetches the URL and processes the response

Intended URLs: public web APIs, user-controlled file hosts

Example: “Import your avatar from this image URL”

What the attacker does

Attacker provides a URL pointing at an internal target

API fetches it — from inside the network, with server credentials

Attacker URLs: http://169.254.169.254/, http://10.0.0.1/admin, file:///etc/passwd

Server returns internal data to the attacker

The key asymmetry

The attacker sitting on the internet cannot directly reach http://169.254.169.254/ or your internal admin panel at http://10.0.0.100/admin. But your API server can — it’s inside the network. SSRF turns your server into a proxy that the attacker controls.

← Back Why APIs specifically? →