API7:2023 — Server Side Request Forgery
Verified by Precogs Threat Research
How does SSRF affect APIs?
SSRF in the context of APIs — webhook URLs, file import from URL, custom integrations, and URL preview features that fetch user-provided URLs without validation, accessing internal services or cloud metadata.
Impact
APIs with webhook or URL-fetch features are prime SSRF targets. Cloud metadata exploitation (AWS IMDSv1) can yield IAM credentials and full account compromise.
How Precogs AI Addresses API7
Precogs AI detects SSRF in API webhook handlers, URL import features, and integration callbacks, testing for internal network and cloud metadata access during Binary DAST.