3 articles tagged with "ssrf"
Every cloud instance carries a tiny, unauthenticated web server strapped to its side, handing out credentials to anyone who asks nicely. Here's why that's terrifying, and the one-line fix most teams still haven't shipped.
Server-Side Request Forgery is the attack behind the Capital One breach, countless cloud credential leaks, and a whole lot of red-faced engineers. If your app fetches URLs, you need to read this.
Server-Side Request Forgery sounds complicated, but the concept is delightfully evil: trick a server into making HTTP requests *it* shouldn't be making, then read what comes back. It took down Capital One. It lives in your URL-fetching code. Let's fix that.