Server-side request abuse is a flaw where an attacker can make a server send requests it was never meant to send. Instead of the attacker contacting an internal service directly, the vulnerable application becomes the proxy and reaches targets on the attacker’s behalf. This matters because servers often have network access that users do not, including access to internal hosts, cloud metadata endpoints, admin panels, or services hidden behind firewalls.
In real attacks, this weakness appears in features that fetch URLs, import remote content, process webhooks, or resolve repository references. An attacker may supply a crafted address, redirect target, or payload that the server follows automatically. Defenses focus on strict allowlists, blocking private and link-local ranges, disabling unnecessary outbound access, and separating internal services from application hosts. Logging and monitoring server-originated requests can also reveal abuse early.