SSRF
Technology & Computing abbreviation · Cybersecurity
| Stands for | Server-side request forgery |
|---|---|
| Categories | Technology & Computing |
SSRF stands for Server-side request forgery, a cybersecurity abbreviation.
A vulnerability in which an attacker makes a server send requests to destinations of the attacker's choosing, often internal systems or cloud metadata services that are not reachable from the internet.
Example: The image-import feature allowed SSRF, letting the tester fetch credentials from the cloud metadata endpoint.
Usage notes
The 2019 Capital One breach, which exposed data on about 100 million people, involved SSRF against AWS's instance metadata service. AWS later introduced IMDSv2, which requires session tokens to blunt such attacks. SSRF entered the OWASP Top 10 as its own category in 2021.
Related abbreviations
More cybersecurity abbreviations
- SOC – Security operations center
- SOC 2 – System and Organization Controls 2
- SPF – Sender Policy Framework
- SQLi – SQL injection
- SSL – Secure Sockets Layer
- SSO – Single sign-on
- TLS – Transport Layer Security
- Tor – The Onion Router
- TOTP – Time-based one-time password
- TPM – Trusted Platform Module
- TTP – Tactics, techniques and procedures
- UTM – Unified threat management