API7:2023 — Server Side Request Forgery

Verified by Precogs Threat Research
OWASP API 2023Rank #7

How does SSRF affect APIs?

SSRF in the context of APIs — webhook URLs, file import from URL, custom integrations, and URL preview features that fetch user-provided URLs without validation, accessing internal services or cloud metadata.

Impact

APIs with webhook or URL-fetch features are prime SSRF targets. Cloud metadata exploitation (AWS IMDSv1) can yield IAM credentials and full account compromise.

Related CWEs

Related Resources

🔍 Related CWE Entries

🛡️ Notable Vulnerabilities

🔗 External References

Risk Overview

CategoryOWASP API 2023
Rank#7
CWEs1

Quick Links

Protect Against API7

Precogs AI continuously scans for API risks across your codebase and binaries.

Start Free Scan

How Precogs AI Addresses API7

Precogs AI detects SSRF in API webhook handlers, URL import features, and integration callbacks, testing for internal network and cloud metadata access during Binary DAST.

Scan for API7 RisksBook a demo