SSRF
Also called server-side request forgery
A feature fetches a URL the user gave it, such as an image from a link. The attacker gives it an internal address, and your server, which sits inside your network, fetches what the attacker could never reach.
Cloud servers can often reach a metadata address that hands out credentials. "Fetch this URL" sounds harmless and takes one line, so it passes without a second look.
Say it to your agent
“This endpoint fetches a URL from the user. Match the host against an allowlist, turn off redirects, and add tests for http://169.254.169.254/, http://127.0.0.1/ and http://2130706433/, which is the same address written as a number.”