> For the complete documentation index, see [llms.txt](https://x7331.gitbook.io/notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://x7331.gitbook.io/notes/htb/api-attacks/ssrf.md). # SSRF > [CWE-918: Server-Side Request Forgery (SSRF)](https://cwe.mitre.org/data/definitions/918.html) * When an API fetches a remote resource without validating the user-supplied URL. * The attacker can force the app to send a request to an unexpected destination, such as localhost, bypassing firewalls or VPNs. The web API stores the path of the files using the `file` URI scheme, which is used to represent local file paths (Figure 1).

Figure 1: Finding a potential vulnerable-to-SSRF endpoint.

This path is stored under the `/supplier-companies/current-user` endpoint (Figure 2).

Figure 2: The URI path is now stored in the application.

The `/api/v1/supplier-companies` `PATCH` endpoint allows the user to modify the URI path (Figure 3); this should not be the case as it should be dynamically set only by the value defined by the `/api/v1/supplier-companies/certificates-of-incorporation` `POST` endpoint.

Figure 3: The URI path can be manually modified by the user.

An attacker could leverage this flaw and read a local file, such as `/etc/passwd` (Figure 4).

Figure 4: Leveraging SSRF to read a local file.

## Exercise