Your 'fetch image from URL' feature lets an attacker request http://169.254.169.254/latest/meta-data/. This is…
Options
- SSRF: Server-Side Request Forgery (Correct option)
- XSS: cross-site scripting
- An open redirect and nothing else
- Session fixation of the user's session
Answer
SSRF (Server-Side Request Forgery)
Why
Your server downloads any URL the user gives. The attacker gives an INTERNAL address that only your server can reach, here the cloud metadata service, which can expose credentials.
The server becomes a tool to reach internal systems: SSRF.
Defenses: allow only expected domains, block private and internal IP ranges (checking after DNS resolution), use IMDSv2 on AWS, and isolate the network.
Remember
SSRF = tricking your server into calling internal addresses.