Slide 8 of 28
Part 1 · What Is It?Slide 8
Slide 8 · Context
New to the 2023 list. Cloud-native APIs made it unavoidable.
SSRF existed in web apps for years — the cloud metadata endpoint made the stakes catastrophically high.
Why it’s a 2023 addition

SSRF was not in the 2019 OWASP API Security Top 10. It was added in 2023 — a direct response to the proliferation of cloud-hosted APIs and the pattern of cloud metadata endpoint exploitation. The Capital One breach (2019), and similar incidents at other companies, demonstrated that SSRF in a cloud environment is categorically more dangerous than in on-premises deployments.

On-premises SSRF (pre-cloud)
Attacker reaches internal network services
Impact: internal data exposure, lateral movement
Requires knowing internal topology
Each target requires discovery
Cloud SSRF (today)
Attacker reaches 169.254.169.254 — always at the same IP, always returns credentials
Impact: full cloud account access, all data in all buckets with that role
No topology discovery needed — metadata endpoint is always the same address
One SSRF request can yield AWS/GCP/Azure account compromise
The relationship to other API risks

SSRF often combines with other failures. A misconfigured IAM role (Security Misconfiguration — API8) makes SSRF credentials more powerful. An internal service with no auth (BFLA — API5 in the internal network) makes internal pivot more dangerous. SSRF is often the entry point; other weaknesses determine how far the attacker gets.

← Back How do attacks work? →