SSRF (Server-Side Request Forgery)

SSRF exploits vulnerabilities that allow attackers to make unauthorized requests from the server to internal or external resources.

Very often no authentication is required for the server’s outgoing requests. This characteristic can be exploited to find protected pages, network nodes and make open redirectsif a SSRF vulnerability is found on the webserver.

Identification

This vulnerability can be found in:

• URL:http://domain/?url=localhost/copyright

• Code source:

Countermeasures:

• Make input validation

• implement network segmentation

• Allow List: Permit only specific, trusted domains or URL