Server-Side Request Forgery (SSRF)

Forces internal server to issue unauthorized HTTP requests to internal-only services.

Core Principles & Analysis

• Central to the 2019 Capital One breach via cloud metadata access.
• Reaches internal-only services hidden behind perimeter firewalls.
• Mitigated with strict URL allowlists and IMDSv2 metadata protections.

Specifications & Metrics

• CVE: CWE-918
• IMPACT: Critical