External service interaction (HTTP)
Summary: PortSwigger describes external service interaction as the ability to induce an application to contact an arbitrary external service, such as a web or mail server, which is not a vulnerability in itself and may be intended behavior. The concern is that an attacker can use the vulnerable server as an attack proxy against public third-party systems, internal systems in the same organization, or services on the application server's own loopback adapter.
Key Takeaway: A server that can be steered into making outbound requests can reach internal services that external attackers cannot, exposing highly vulnerable systems depending on the network architecture. PortSwigger's recommended controls are blocking network access from the application server to other internal systems, hardening the server to remove loopback services, and whitelisting permitted hosts.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026