A library feature fetches a user-supplied URL from the application server to generate link previews. What vulnerability class should the tester investigate first?
Select an answer to reveal the explanation.
Short Explanation
When the server itself runs errands you typed, it might visit rooms you should not reach. That is SSRF — server-side request forgery toward internals or cloud metadata. Huge theme in modern apps; classify it without a payload dump.
Full Explanation
Server-Side Request Forgery arises when applications request URLs influenced by attackers, potentially contacting internal hosts, link-local services, or cloud instance metadata. Impact includes recon of internal networks and credential or secret exposure in cloud environments. Controls include allowlists, blocking private ranges, and network egress restrictions. Client-only redirects or email-auth distractors miss the server-initiated request risk.