SSRF flaws occur when a web app fetches a remote resource without validating the user-supplied URL. Attackers can coerce the app to send a request to an unexpected destination—even if it’s secured by a firewall, VPN, or other network access control list (ACL).
The OWASP Top 10 is a broad consensus about the most critical security risks to web applications. The update gives guidance to help secure modern web applications and architectures from exploits, abuse, and misconfiguration, as well as recommendations for mitigating new risks involving software supply chains, CI/CD pipelines, and open source software.
Watch the OWASP Top 10 Lightboard Lesson series for a breakdown of the OWASP Top 10 and learn:
• How OWASP creates its Top 10 list of the most critical security risks to web applications.
• Key changes including recategorization of risk to align symptoms to root causes.
• When each risk can manifest, why it matters, and how to improve your security posture.
The Open Web Application Security Project (OWASP) is a nonprofit foundation that works to improve the security of software. OWASP maintains a variety of projects, including the Top 10 web application security risks standard awareness document for developers and security practitioners.