An attack where, if a user can control external requests from a server, the attacker forces the server to access internal network services (metadata APIs, internal databases, etc.). This is ...