Server-side request forgery, or SSRF, is a vulnerability in which an attacker tricks a server into making requests that the attacker chooses. The server sends the request from its own position on the network, so it may be able to reach internal systems, cloud metadata services or private addresses that the attacker cannot access directly.
The consequences depend on what the server can reach. An SSRF flaw may let an attacker scan internal services, read data from internal endpoints or retrieve credentials from a cloud metadata service. In some cases it can be chained with other weaknesses to go further.
Not every SSRF is severe. Some only allow requests to a limited set of destinations, or return no response to the attacker, which reduces the impact, though they may still be useful for probing. The effect depends on the application, its network position and the controls around it.
Defenses include validating and restricting the destinations a server may contact, preferably with an allowlist, blocking requests to internal and metadata addresses, limiting outbound network access, and using protections that harden cloud metadata services. Apply vendor fixes for known SSRF flaws and review logs for unexpected outbound requests.