Issue Details
Server Side Request Forgery
api07-2023 • Rank #7 in OWASP 2023
Explanation
SSRF allows attackers to coerce backend systems into making requests to internal or privileged network locations. In API architectures, this often occurs in URL fetchers, webhooks, import features, and metadata resolvers. Successful SSRF can expose internal services, cloud metadata, and hidden control planes.
Remedy
Enforce strict outbound destination allowlists, normalize and validate URLs, and block private/internal address ranges. Isolate metadata services and apply egress controls at network boundaries. Log and alert on unusual outbound patterns, especially requests to internal address space.
| Year | Rank | Category |
|---|---|---|
| 2023 | #7 | api07-2023 - Server Side Request Forgery |