Config files : Server-Side Request Forgery (SSRF)

Server-Side Request Forgery (SSRF) is possible.

A Server Side Request Forgery (SSRF) vulnerability allows an attacker to change a parameter used by the web application to create or manage requests from a vulnerable server.

When the manipulated request goes to the server, the server-side code picks up the manipulated URL and tries to read data to the manipulated URL. By selecting target URLs the attacker may be able to read data from services that are not directly exposed on the internet:

• Cloud server meta-data
• Database HTTP interfaces
• Internal REST interfaces
• Files (using file:// URIs)