Server-Side Request Forgery
High · Injection
OWASP Top 10:2025 (current)
A01:2025 — Broken Access Control
Historical Top 10:2021 (not current)
A10:2021 — kept for older reports; use 2025 above.
CWE
CWE-918
CVE / class examples
- Search NVD/CVE for product-specific instances of this CWE
All refs
OWASP A01:2025 · OWASP A10:2021 · CWE-918
Definition
Server is made to request attacker-chosen URLs.
Root cause
Fetching user-supplied URLs without validation.
Affected components
- URL fetchers
- Webhooks
- PDF/preview services
- Cloud metadata
Impact
Access to internal services and cloud metadata.
Severity
High
Safe lab reproduction
PortSwigger SSRF labs
Detection methodology
Outbound request logs to internal ranges/metadata IPs.
Evidence examples
- Outbound to 169.254.169.254 blocked/logged in lab
Remediation
Allow-lists, block internal ranges, IMDSv2.
Secure coding examples
Validate and resolve URLs server-side against an allow-list.
Related CYNARKS lessons & labs
Tools: burp
Primary 2025 class: A01:2025 — Broken Access Control
Practise related skills in Labs or deepen on Academy library.