CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
4710 vulnerabilities reference this CWE, most recent first.
GHSA-JFR3-MC8C-WQGX
Vulnerability from github – Published: 2026-06-25 21:31 – Updated: 2026-06-25 21:31Two data sources (DICOMWebProxy and DICOMJSON) shipped in the default configuration fetch an arbitrary URL parameter without validation. A global authentication service in OHIF automatically injects the authenticated user's OIDC Bearer token into the resulting requests, sending it to the attacker-controlled server. DICOMweb data sources are not impacted.
{
"affected": [],
"aliases": [
"CVE-2026-12473"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-25T21:16:26Z",
"severity": "HIGH"
},
"details": "Two data sources (DICOMWebProxy and DICOMJSON) shipped in the default configuration fetch an arbitrary URL parameter without validation. A global authentication service in OHIF automatically injects the authenticated user\u0027s OIDC Bearer token into the resulting requests, sending it to the attacker-controlled server. DICOMweb data sources are not impacted.",
"id": "GHSA-jfr3-mc8c-wqgx",
"modified": "2026-06-25T21:31:31Z",
"published": "2026-06-25T21:31:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12473"
},
{
"type": "WEB",
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-176-02.json"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsma-26-176-02"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-JFWQ-PFCR-9F47
Vulnerability from github – Published: 2022-09-21 00:00 – Updated: 2022-09-22 00:00A Server-Side Request Forgery (SSRF) in fetch_net_file_upload function of baijiacmsV4 v4.1.4 allows remote attackers to force the application to make arbitrary requests via injection of arbitrary URLs into the url parameter.
{
"affected": [],
"aliases": [
"CVE-2022-38931"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-09-20T20:15:00Z",
"severity": "HIGH"
},
"details": "A Server-Side Request Forgery (SSRF) in fetch_net_file_upload function of baijiacmsV4 v4.1.4 allows remote attackers to force the application to make arbitrary requests via injection of arbitrary URLs into the url parameter.",
"id": "GHSA-jfwq-pfcr-9f47",
"modified": "2022-09-22T00:00:22Z",
"published": "2022-09-21T00:00:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38931"
},
{
"type": "WEB",
"url": "https://github.com/zer0yu/CVE_Request/blob/master/baijiacms/baijiacmsv4_ssrf.md"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-JG34-VVWH-5QV9
Vulnerability from github – Published: 2024-05-15 18:30 – Updated: 2025-01-21 18:31Server Side Request Forgery vulnerability has been discovered in OpenText™ iManager 3.2.6.0200. This could lead to senstive information disclosure.
{
"affected": [],
"aliases": [
"CVE-2024-3485"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-15T17:15:13Z",
"severity": "MODERATE"
},
"details": "Server Side Request Forgery vulnerability\u00a0has been discovered in OpenText\u2122 iManager 3.2.6.0200. This\ncould lead to senstive information disclosure.",
"id": "GHSA-jg34-vvwh-5qv9",
"modified": "2025-01-21T18:31:03Z",
"published": "2024-05-15T18:30:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3485"
},
{
"type": "WEB",
"url": "https://www.netiq.com/documentation/imanager-32/imanager326_patch3_hf1_releasenotes/data/imanager326_patch3_hf1_releasenotes.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JG5R-V2H9-WFXX
Vulnerability from github – Published: 2025-03-20 12:32 – Updated: 2025-03-20 12:32A Server-Side Request Forgery (SSRF) vulnerability was identified in the Requests utility of significant-gravitas/autogpt versions prior to v0.4.0. The vulnerability arises due to a hostname confusion between the urlparse function from the urllib.parse library and the requests library. A malicious user can exploit this by submitting a specially crafted URL, such as http://localhost:\@google.com/../, to bypass the SSRF check and perform an SSRF attack.
{
"affected": [],
"aliases": [
"CVE-2025-0454"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-20T10:15:53Z",
"severity": "HIGH"
},
"details": "A Server-Side Request Forgery (SSRF) vulnerability was identified in the Requests utility of significant-gravitas/autogpt versions prior to v0.4.0. The vulnerability arises due to a hostname confusion between the `urlparse` function from the `urllib.parse` library and the `requests` library. A malicious user can exploit this by submitting a specially crafted URL, such as `http://localhost:\\@google.com/../`, to bypass the SSRF check and perform an SSRF attack.",
"id": "GHSA-jg5r-v2h9-wfxx",
"modified": "2025-03-20T12:32:52Z",
"published": "2025-03-20T12:32:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0454"
},
{
"type": "WEB",
"url": "https://github.com/significant-gravitas/autogpt/commit/ff065cd24c2289878c0abdb9adbf91c305f0d70a"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/0664fdee-bdc2-4650-8075-74d7b8d3e308"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JG7M-PJJ3-MQMQ
Vulnerability from github – Published: 2026-02-19 21:30 – Updated: 2026-02-19 21:30SPIP before 4.4.9 allows Blind Server-Side Request Forgery (SSRF) via syndicated sites in the private area. When editing a syndicated site, the application does not verify that the syndication URL is a valid remote URL, allowing an authenticated attacker to make the server issue requests to arbitrary internal or external destinations. This vulnerability is not mitigated by the SPIP security screen.
{
"affected": [],
"aliases": [
"CVE-2026-27472"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-19T19:22:30Z",
"severity": "MODERATE"
},
"details": "SPIP before 4.4.9 allows Blind Server-Side Request Forgery (SSRF) via syndicated sites in the private area. When editing a syndicated site, the application does not verify that the syndication URL is a valid remote URL, allowing an authenticated attacker to make the server issue requests to arbitrary internal or external destinations. This vulnerability is not mitigated by the SPIP security screen.",
"id": "GHSA-jg7m-pjj3-mqmq",
"modified": "2026-02-19T21:30:47Z",
"published": "2026-02-19T21:30:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27472"
},
{
"type": "WEB",
"url": "https://blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-4-9.html"
},
{
"type": "WEB",
"url": "https://git.spip.net/spip/spip"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/spip-blind-server-side-request-forgery-via-syndicated-sites"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-JGH8-VCHW-Q3G7
Vulnerability from github – Published: 2023-01-27 01:04 – Updated: 2024-11-26 16:13Description
In SafeURL it is possible to specify a list of domains that should be matched before a request is sent out. The regex used to compare domains did not work as intended.
Impact
The regex used was:
re.match("(?i)^%s" % domain, value)
This has two problems, first that only the beginning and not the end of the string is anchored. Second, that a dot in the domain matches any character as part of regex syntax.
Therefore, an allowlist of ["victim.com"] could allow the domain "victimacomattacker.com" to be requested.
This has lower impact since the usual attacker aim in an SSRF is to request internal resources such as private IP addresses rather than an attacker's own domain. But, in a case where SafeURL had specifically been used to try to limit requests to a particular allowlist, say for example a PDF renderer, the finding would be more severe.
Patches
Fixed in https://github.com/IncludeSecurity/safeurl-python/pull/5
References
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "safeurl-python"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-24622"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2023-01-27T01:04:27Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Description\nIn SafeURL it is possible to specify a list of domains that should be matched before a request is sent out. The regex used to compare domains did not work as intended.\n\n### Impact\nThe regex used was:\n\n`re.match(\"(?i)^%s\" % domain, value)`\n\nThis has two problems, first that only the beginning and not the end of the string is anchored. Second, that a dot in the domain matches any character as part of regex syntax.\n\nTherefore, an allowlist of [\"victim.com\"] could allow the domain \"victimacomattacker.com\" to be requested.\n\nThis has lower impact since the usual attacker aim in an SSRF is to request internal resources such as private IP addresses rather than an attacker\u0027s own domain. But, in a case where SafeURL had specifically been used to try to limit requests to a particular allowlist, say for example a PDF renderer, the finding would be more severe.\n\n### Patches\nFixed in https://github.com/IncludeSecurity/safeurl-python/pull/5\n\n### References\n[Server-side request forgery (SSRF)](https://portswigger.net/web-security/ssrf)",
"id": "GHSA-jgh8-vchw-q3g7",
"modified": "2024-11-26T16:13:13Z",
"published": "2023-01-27T01:04:27Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/IncludeSecurity/safeurl-python/security/advisories/GHSA-jgh8-vchw-q3g7"
},
{
"type": "WEB",
"url": "https://github.com/IncludeSecurity/safeurl-python/pull/5/commits/42dd0c8e5fc84e17e1d3578d18aaea169eece474"
},
{
"type": "PACKAGE",
"url": "https://github.com/IncludeSecurity/safeurl-python"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/safeurl-python/PYSEC-2023-298.yaml"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "safeurl-python contains Server-Side Request Forgery"
}
GHSA-JGV7-F85P-M95J
Vulnerability from github – Published: 2024-08-07 00:30 – Updated: 2024-08-07 00:30An authenticated attacker can bypass Server-Side Request Forgery (SSRF) protection in Microsoft Copilot Studio to leak sensitive information over a network.
{
"affected": [],
"aliases": [
"CVE-2024-38206"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-06T22:15:54Z",
"severity": "HIGH"
},
"details": "An authenticated attacker can bypass Server-Side Request Forgery (SSRF) protection in Microsoft Copilot Studio to leak sensitive information over a network.",
"id": "GHSA-jgv7-f85p-m95j",
"modified": "2024-08-07T00:30:47Z",
"published": "2024-08-07T00:30:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38206"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38206"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JGVC-94C8-3CHC
Vulnerability from github – Published: 2026-04-29 22:19 – Updated: 2026-05-13 13:38Impact
OGC API - Process execution requests can use the subscriber object to requests to internal HTTP services.
Patches
The issue has been patched in master branch and made available as part of the 0.23.3 release. The patch disables any HTTP requests made to internal resources by default (unless explicitly defined in configuration by a new allow_internal_requests directive.
The commit/fix can be found in 3a63f5b0cc6275e3ae0edb47726b13a43cdd90ef.
Workarounds
Users can update existing applications by disabling process based resources in their pygeoapi config, until 0.23.3 can be installed and deployed.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "pygeoapi"
},
"ranges": [
{
"events": [
{
"introduced": "0.23.0"
},
{
"fixed": "0.23.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-42352"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-29T22:19:53Z",
"nvd_published_at": "2026-05-08T23:16:38Z",
"severity": "HIGH"
},
"details": "### Impact\nOGC API - Process execution requests can use the `subscriber` object to requests to internal HTTP services.\n\n### Patches\nThe issue has been patched in master branch and made available as part of the 0.23.3 release. The patch disables any HTTP requests made to internal resources by default (unless explicitly defined in configuration by a new `allow_internal_requests` directive.\n\nThe commit/fix can be found in [3a63f5b0cc6275e3ae0edb47726b13a43cdd90ef](https://github.com/geopython/pygeoapi/commit/3a63f5b0cc6275e3ae0edb47726b13a43cdd90ef).\n\n### Workarounds\nUsers can update existing applications by disabling process based resources in their pygeoapi config, until 0.23.3 can be installed and deployed.",
"id": "GHSA-jgvc-94c8-3chc",
"modified": "2026-05-13T13:38:17Z",
"published": "2026-04-29T22:19:53Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/geopython/pygeoapi/security/advisories/GHSA-jgvc-94c8-3chc"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42352"
},
{
"type": "WEB",
"url": "https://github.com/geopython/pygeoapi/commit/3a63f5b0cc6275e3ae0edb47726b13a43cdd90ef"
},
{
"type": "PACKAGE",
"url": "https://github.com/geopython/pygeoapi"
},
{
"type": "WEB",
"url": "https://github.com/geopython/pygeoapi/releases/tag/0.23.3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "pygeoapi 0.23.x: Unauthenticated SSRF via OGC API - Processes Subscriber "
}
GHSA-JGX9-JR5X-MVPV
Vulnerability from github – Published: 2026-07-07 16:51 – Updated: 2026-07-07 16:51Summary
There is a blind server side request forgery in the functionality that allows editing an image via a prompt. The affected function will perform a GET request on the URL provided by the user. There is no restriction on the domain of the provided URL allowing the local address space to be interacted with. Since the SSRF is blind (the response cannot be read) impact is port scanning of the local network because it can be confirmed if the port is open based on if the GET request failed.
Details
The vulnerability occurs here:
https://github.com/open-webui/open-webui/blob/2b26355002064228e9b671339f8f3fb9d1fafa73/backend/open_webui/routers/images.py#L850-L916
Line 911 shows the user provided URL passed to the function load_url_image. Within this function on line 883 HTTP/HTTPs URLs are trusted blindly and called asynchronously with requests.get.
PoC
The vulnerability can be reproduced with the following curl command:
curl -X POST http://localhost:3000/api/v1/images/edit \
-H "Authorization: Bearer <token>" \
-H "Content-Type: application/json" \
-d '{"form_data":{
"image": "<url>",
"prompt": "poc"}
}'
Impact
Response differentials can be used to port scan the local network:
This can be automated to iterate through the entire port range to determine open ports. If the service running on an open port can be inferred the user may be able to interact with it in a meaningful way if the service offers any state changing GET request endpoints.
Remediation
Restrict provided URLs from local address space.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "open-webui"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.7.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-34225"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-07T16:51:30Z",
"nvd_published_at": "2026-04-14T02:16:04Z",
"severity": "MODERATE"
},
"details": "### Summary\nThere is a blind server side request forgery in the functionality that allows editing an image via a prompt. The affected function will perform a GET request on the URL provided by the user. There is no restriction on the domain of the provided URL allowing the local address space to be interacted with. Since the SSRF is blind (the response cannot be read) impact is port scanning of the local network because it can be confirmed if the port is open based on if the GET request failed.\n\n### Details\nThe vulnerability occurs here:\nhttps://github.com/open-webui/open-webui/blob/2b26355002064228e9b671339f8f3fb9d1fafa73/backend/open_webui/routers/images.py#L850-L916\nLine 911 shows the user provided URL passed to the function `load_url_image`. Within this function on line 883 HTTP/HTTPs URLs are trusted blindly and called asynchronously with `requests.get`. \n\n### PoC\nThe vulnerability can be reproduced with the following curl command:\n```\ncurl -X POST http://localhost:3000/api/v1/images/edit \\\n -H \"Authorization: Bearer \u003ctoken\u003e\" \\\n -H \"Content-Type: application/json\" \\\n -d \u0027{\"form_data\":{\n \"image\": \"\u003curl\u003e\",\n \"prompt\": \"poc\"}\n }\u0027\n```\n\n### Impact\nResponse differentials can be used to port scan the local network:\n\u003cimg width=\"3016\" height=\"736\" alt=\"image\" src=\"https://github.com/user-attachments/assets/93b4df52-b23c-4ed7-a5fa-9cbedb30091c\" /\u003e\nThis can be automated to iterate through the entire port range to determine open ports. If the service running on an open port can be inferred the user may be able to interact with it in a meaningful way if the service offers any state changing GET request endpoints.\n\n### Remediation\nRestrict provided URLs from local address space.",
"id": "GHSA-jgx9-jr5x-mvpv",
"modified": "2026-07-07T16:51:30Z",
"published": "2026-07-07T16:51:30Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-jgx9-jr5x-mvpv"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34225"
},
{
"type": "PACKAGE",
"url": "https://github.com/open-webui/open-webui"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Open WebUI has Blind Server Side Request Forgery in its Image Edit Functionality"
}
GHSA-JH2C-2H3P-FCJ3
Vulnerability from github – Published: 2024-01-23 21:30 – Updated: 2025-06-20 21:31A post-authenticated server-side request forgery (SSRF) vulnerability in Trend Micro Apex Central 2019 (lower than build 6481) could allow an attacker to interact with internal or local services directly.
Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
This is a similar, but not identical vulnerability as CVE-2023-38624.
{
"affected": [],
"aliases": [
"CVE-2023-38625"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-23T21:15:08Z",
"severity": "MODERATE"
},
"details": "A post-authenticated server-side request forgery (SSRF) vulnerability in Trend Micro Apex Central 2019 (lower than build 6481) could allow an attacker to interact with internal or local services directly.\n\nPlease note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.\n\nThis is a similar, but not identical vulnerability as CVE-2023-38624.",
"id": "GHSA-jh2c-2h3p-fcj3",
"modified": "2025-06-20T21:31:49Z",
"published": "2024-01-23T21:30:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-38625"
},
{
"type": "WEB",
"url": "https://success.trendmicro.com/dcx/s/solution/000294176?language=en_US"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-999"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.