SSRF Server-Side Request Forgery
Server-Side Request Forgery — attacker forces server to make HTTP requests to URLs the attacker wants (often internal network or cloud-metadata endpoints). OWASP Top 10 #10 2021.
Classic vector: app accepts URL param for "fetch image from URL" → attacker passes http://169.254.169.254/latest/meta-data/iam/security-credentials/ (AWS IMDSv1 metadata) → server returns IAM credentials. Capital One breach 2019: SSRF against internal Apache + AWS metadata = 100M+ customer records leaked. Defense: allowlist validation of target URL, deny private IPs (RFC1918 + 169.254/16 + 127.0.0.0/8 + ::1), IMDSv2 (requires session token, not responsive to SSRF). Cloud default: IMDSv2-only on EC2 since 2020.