External service interaction (SMTP)
Summary: PortSwigger describes external service interaction as the ability to induce an application to contact an arbitrary external service, such as a web or mail server, and notes this is not a vulnerability in itself and may be intended behavior. The concern is that an attacker can use the vulnerable server as an attack proxy to reach public third-party systems, internal systems in the same organization, or services on the application server's own loopback adapter, potentially exposing internal services not otherwise reachable from outside.
What's compelling: A server that can be told to make outbound requests becomes a launch point into internal systems and loopback services that external attackers cannot reach directly, so the network path from the application server is the exposure that matters.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026