SSRF — Server-Side Request Forgery

SSRF tricks the server into making HTTP requests to internal services the attacker cannot reach directly. The attacker controls the URL; the server fetches it.

In AWS Lambda, internal services include the Lambda Runtime API on localhost:9001 and cloud metadata endpoints. These are never exposed to the internet, but an SSRF vulnerability lets the attacker reach them through the Lambda function itself.

SSRF to cloud metadata is one of the most common cloud attack paths. The 2019 Capital One breach used SSRF against IMDSv1 metadata to steal IAM credentials and access over 100 million customer records.

OWASP Serverless Top 10: SLS-3 — Sensitive Data Exposure