What API7:2023 Server Side Request Forgery requires
OWASP API Security Top 10 (2023) API7:2023 Server Side Request Forgery. Server-Side Request Forgery (SSRF) flaws occur when an API is fetching a remote resource without validating the user-supplied URL. It enables an attacker to coerce the application to send a crafted request to an unexpected destination, even when protected by a firewall or a VPN. Modern concepts in application development make SSRF more common and more dangerous. More common - the following concepts encourage developers to access an external resource based on user input: Webhooks, file fetching from URLs, custom SSO, and URL previews. More dangerous - Modern technologies like cloud providers, Kubernetes, and Docker expose management and control channels over HTTP on predictable, well-known paths. Those channels are an easy target for an SSRF attack. It is also more challenging to limit outbound traffic from your application, because of the connected nature of modern applications. The SSRF risk can not always be completely eliminated. While choosing a protection mechanism, it is important to consider the business risks and needs. This category sits within the OWASP API Security Top 10 (2023 edition), the canonical industry list of the ten most critical API security risks. Organizations implementing API services should treat each of the ten categories as both a design constraint and a continuous-monitoring obligation, with policies, automated testing, and incident response procedures defined per category.
Pillar: Cybersecurity · Authority: OWASP Foundation (Open Worldwide Application Security Project) · Version: 1.0.0 · Last updated:
Primary source: https://owasp.org/API-Security/editions/2023/en/0xa7-server-side-request-forgery/
SHA-256 integrity: c1aaeb1adb1f8441ce6d2df193c7463b86264582805675c3e7507d13a7aa79c6
Primary Citations — 12 traced to source
- OWASP API Security Top 10 (2023), API07:2023 Server Side Request Forgery, How To Prevent: 'Isolate the resource fetching mechanism in your network: usually these features are aimed to retrieve remote resources and not internal ones.'
- OWASP API Security Top 10 (2023), API07:2023 Server Side Request Forgery, How To Prevent: 'Whenever possible, use allow lists of: * Remote origins users are expected to download resources from (e.g. Google Drive, Gravatar, etc.) * URL schemes and ports * Accepted media types for a given functionality'
+ 10 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.
Access
- Discovery (free): /api/v1/nodes/owasp-api-top-10-2023-api07-server-side-request-forgery.json — 6-field metadata
- Vault (full node): /api/v1/vault/nodes/owasp-api-top-10-2023-api07-server-side-request-forgery.json — full 13-key payload, $0.01 USDC (L402/Skyfire/Direct Base)
- Canonical URL: https://bidda.com/intelligence/owasp-api-top-10-2023-api07-server-side-request-forgery
- Back to registry: Browse all 10,108 compliance nodes