SSRF Server-Side Request Forgery
Server-Side Request Forgery — attacker tvingar server att göra HTTP-requests till URLs som attacker vill (oftast internal network eller cloud-metadata-endpoints). OWASP Top 10 #10 2021.
Klassisk vector: app accepterar URL-param för "fetch image from URL" → attacker passes http://169.254.169.254/latest/meta-data/iam/security-credentials/ (AWS IMDSv1 metadata) → server returnerar IAM-credentials. Capital One-breach 2019: SSRF mot internal Apache + AWS metadata = 100M+ customer-records läckte. Defense: allowlist-validation av target-URL, deny private-IPs (RFC1918 + 169.254/16 + 127.0.0.0/8 + ::1), IMDSv2 (requires session-token, ej responsive till SSRF). Cloud-default: IMDSv2-only på EC2 sedan 2020.