SSRF Server-Side Request Forgery — Using the Server as a Proxy into the Internal Network

The server trusts a user-supplied URL and becomes the attacker's pivot into internal services. A firewall stops external traffic, but it can't stop the server's own outbound requests.