{
  "slug": "server-side-request-forgery",
  "url": "https://library.infinity8labs.com/server-side-request-forgery/",
  "title": "Server-side request forgery (SSRF)",
  "short": "SSRF",
  "aliases": [
    "Server-side request forgery",
    "Blind SSRF",
    "Cross-service request forgery"
  ],
  "summary": "SSRF lets an attacker make the application server send requests to destinations the attacker could not normally reach. It can expose internal services, cloud metadata, credentials, and trusted administrative interfaces.",
  "cwe": [
    "CWE-918"
  ],
  "owasp": "A10:2021 Server-Side Request Forgery",
  "typical_severity": {
    "min": "medium",
    "max": "critical"
  },
  "updated": "2026-10-15",
  "references": [
    {
      "title": "CWE-918: Server-Side Request Forgery",
      "url": "https://cwe.mitre.org/data/definitions/918.html"
    },
    {
      "title": "OWASP Top 10 A10:2021 Server-Side Request Forgery",
      "url": "https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/"
    },
    {
      "title": "OWASP Server-Side Request Forgery Prevention Cheat Sheet",
      "url": "https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html"
    },
    {
      "title": "PortSwigger Web Security Academy: Server-side request forgery",
      "url": "https://portswigger.net/web-security/ssrf"
    }
  ],
  "sections": [
    "https://library.infinity8labs.com/server-side-request-forgery/#overview",
    "https://library.infinity8labs.com/server-side-request-forgery/#impact",
    "https://library.infinity8labs.com/server-side-request-forgery/#examples",
    "https://library.infinity8labs.com/server-side-request-forgery/#remediation",
    "https://library.infinity8labs.com/server-side-request-forgery/#testing",
    "https://library.infinity8labs.com/server-side-request-forgery/#references"
  ]
}