Definition
Server-side request forgery SSRF is a web security vulnerability that allows an attacker to induce the server-side application to make HTTP requests to an arbitrary domain of the attackers choosing. This occurs when a web application fetches a remote resource without validating the user-supplied URL. Attackers can exploit SSRF to access internal systems, scan networks, or exfiltrate data that the server has access to. For instance, an attacker might use SSRF to access cloud metadata endpoints, revealing sensitive credentials. Unlike cross-site scripting XSS which targets the user's browser SSRF targets the server itself. This vulnerability is a common topic on security certifications like CompTIA Security+ and CySA+.