Box: Cloud Misconfig (S3 + IAM + SSRF)

box · hard · +140 XP

// what is Box: Cloud Misconfig (S3 + IAM + SSRF)?

Cloud SSRF → IMDS → IAM creds → S3 — every cloud VM has a metadata service at 169.254.169.254 (AWS) that hands out IAM credentials to whoever asks from inside the VM. If your web app has SSRF, an attacker asks the metadata service for you and walks out with credentials that can list S3 buckets, read secrets, spin up bitcoin miners. The Capital One breach.

// how attackers detect it

[01]Find any URL-fetch endpoint in the app. SSRF the metadata service: http://169.254.169.254/latest/meta-data/iam/security-credentials/.
[02]On AWS, you'll get the role name; then .../role-name to get the actual creds. They're short-lived (15-60 min) but enough.
[03]Tools: aws-cli with stolen creds, pacu (AWS exploitation framework), cloudfox (post-exploitation enum).

// how defenders prevent it

✓Enforce IMDSv2 on AWS (session-token required for IMDS calls) — IMDSv1 is the SSRF target.
✓VPC endpoints + SCP policies — even with creds, can the attacker call S3/Secrets/RDS from the open internet?
✓Least-privilege IAM — the EC2 role for the web tier should NOT have s3:* and secretsmanager:*.

// real-world incidents

CVE-2019-3396

Capital One breach (root cause)

100M customer records via WAF SSRF + IMDSv1.

CVE-2023-26156

Skiff IMDS leak via webhook

Email service IMDS SSRF.

// hands-on tips for this lab

›Blocklist contains localhost/127.0.0.1. Use 169.254.169.254 (the IMDS IP) directly. Then s3/list?bucket=prod-flags → s3/get?bucket=prod-flags&key=flag.bin&token=<stolen-iam>.

was this lesson helpful?

Box: Legacy Admin Panel (chained)

Box: GraphQL + Mass Assignment

2 of 9 · box

Box: Cloud Misconfig (S3 + IAM + SSRF)

// go deeper

we run on minimal cookies.