What it is#
arises any time an attacker can influence the destination of a server-originated HTTP, FTP, or gopher request. Classic sinks include webhook registration, URL previews, avatar fetchers, and PDF renderers that follow embedded image tags. Because the request originates from inside the perimeter, it inherits the server’s network position — which is the attacker’s whole prize.
Why it matters#
Cloud-metadata services (169.254.169.254), internal admin panels, and private Kubernetes API servers are all reachable over plain HTTP from application workloads. An that hits any of those surfaces is usually one hop from credential theft and lateral movement.
Mitigation direction#
Enforce an allowlist of outbound hosts and protocols at the HTTP client layer. Resolve hostnames before dispatching the request, reject private address ranges by default, and refuse to follow redirects into new host families. Add egress firewall rules that are independent of application logic so a bypass does not bridge the network control.