Unpatched Powerful SSRF in Exchange OWA – Getting Response Through Attachments

This report discusses Server Side Request Forgery (SSRF) as a web application vulnerability, describing categories for evaluating SSRF findings: internal vs. external application, exposure of loopback services, privileges required, and what can be achieved (request shaping and response handling). It emphasizes that SSRF impact depends on context—especially whether responses are returned and what protocols and request controls are available—and that vendor assessments may differ from attacker evaluations.