Weakness
Server-side request forgery
SSRF
Making a server fetch a URL of the attacker's choosing, often one inside the private network.
Servers that fetch URLs (to preview links or import files) can be pointed at internal services that are not exposed to the internet, such as cloud metadata endpoints that hand out credentials.
Server-side request forgery in the news
Recent stories that mention it.
The weakness behind it
Its CWE entry, with CVEs in the news, attacker techniques and the controls that stop it.
Related
Plain-language explainers written by SecurityTabs, matched to stories by name. All terms