Server-side request forgery
Also known as SSRF
Making an application fetch a URL of the attacker's choosing, reaching systems they could not access directly.
The application becomes the attacker's proxy. Because the request originates from a trusted server, it can reach internal services and, in cloud environments, metadata endpoints that hand out credentials.
It has become one of the more serious application vulnerability classes precisely because of that cloud credential angle.
Where this comes up
Server-side request forgery sits inside our penetration testing work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.