What is SSRF (Server-Side Request Forgery)?

Short answer

SSRF (Server-Side Request Forgery) is the attack of abusing the features in which the server makes a request to an address given by the user (URL preview, file download, webhook) to steer the server into making requests to resources in the internal network, to cloud metadata services (e.g. 169.254.169.254) or to other targets that cannot be reached from outside; since the request originates from the trusted server, it can bypass the access restrictions at the network layer (CWE-918, OWASP). In TR7 WAF, the Server-Side Request Forgery category (140 rules) of the built-in Signature & Rule Library looks for these attempts in the incoming request; matching requests appear in WAF Event Logs with this category in the Category field.

Where It Is Used in TR7

Where	Field / label	What for
Configuration Menu → WAF → Signature & Rule Library; the OWASP Rules screen of the vService	The Signature Category column (hidden by default); Filter → Signature Categories → Server-Side Request Forgery; Protected Target Types → Metadata Service	Listing the rules in the category and the rules that target the cloud metadata service
WAF Event Logs and Global WAF Event Log	The Category column (hidden by default), the Category tab in the filter strip, the Category row on the Summary and Attacks tabs of the record preview	Seeing that the request was caught by a signature in this category
WAF Dashboard	The Detected Attacks by Category panel	The density of the detections in the category over time
WAF report	The Classification view	The category breakdown in the report

• What the rules look for, their scores, the fields they work in and what to do in case of a false positive: Is there protection against SSRF and cloud metadata (169.254.169.254) access attempts?
• The great majority of the signatures in the category are mapped to the A10:2021 (Server-Side Request Forgery) item in OWASP Top 10 Web and the API7:2023 item in OWASP API Top 10.

Common Misconceptions

• "SSRF harms only external systems." The real risk is that the server can access the internal network and cloud metadata services; these services can return temporary access keys.
• "The internal network is protected by the firewall." Since the request originates from the trusted server, it is within the traffic that the firewall allows into the internal network.
• "WAF also inspects the connections the server opens to the outside." WAF inspects only the incoming request; the connections opened by the Backend Service itself are restricted at the network layer.

How it is done in the documentation

• Signature & Rule Library · Signature Categories
• Signature & Rule Library · Protected Target Types
• Event Logs · The Filterable Information

Related questions

• Is there protection against SSRF and cloud metadata (169.254.169.254) access attempts?
• Which attack categories do the signatures cover?
• What is the difference between the OWASP Top 10 (Web) and the OWASP API Top 10?