What is it
SSRF occurs when an application fetches a URL supplied by a user without adequately restricting where that URL may point.
How it works
The application accepts a URL for a legitimate reason — importing an image, checking a webhook, generating a preview. The attacker supplies an internal address instead. The request originates from the server, which sits inside the network perimeter and often holds credentials the attacker does not.
In cloud environments the classic target is the instance metadata service, which can return credentials for the machine's role.
Why it matters
SSRF converts a minor input-handling oversight into access to internal systems that were never intended to be reachable from outside.
What can happen
Internal service enumeration, cloud credential theft, access to admin interfaces bound to localhost, and in some cases remote code execution.
How to detect it
Outbound requests from application servers to internal addresses, requests to metadata endpoints, and unusual patterns in application-initiated traffic.
How to defend
Allowlist destinations rather than blocklisting them. Resolve and validate the address after DNS resolution, not before. Block metadata endpoints at the network layer. Require authentication on internal services. Run fetches from an isolated egress path.