To handle a http request an application server can make other api requests to other internal services (which may not be be directly be reachable by end user) . These internal services may be available only on private IP. Since the internal services are protected by network topology they may have weaker security. Any service inside the network may be able to interact with internal service. Typically SSRF attack is usually based on application server using URL derived from user input and hence by controlling the url the attacker can execute unauthorized actions or access to data . 

How to protect against SSRF attack

• black list based input filters . eg applications may block
  • 127.0.0.1 or
  • localhost 
  • sensitive urls like /password
• white list based input filters ,(the filter may be using begins with/contains logic). note that while list based input filters may be circumvented by
  • embedding crediential in a URL before hostname eg https://expected-host@evil-host
  • use the # character to indicate a URL fragment. eg https://evil-host#expected-host
  • leveraging the DNS naming hierarchy to place required input into a fully-qualified DNS name that you control. eg: https://expected-host.evil-host. 

Read more

• https://portswigger.net/web-security/ssrf
• https://portswigger.net/web-security/ssrf/blind (in blind ssrf, application can be induced to issue a back-end HTTP request to a user provided  URL, but the response from the back-end is not returned in the application's front-end )