EC2 meta data abuse
Last updated
Last updated
EC2 Instance metadata is data about your instance that you can use to configure or manage the running instance.
Although you can only access instance metadata and user data from within the instance itself, the data is not protected by cryptographic methods. Anyone who can access the instance can view its metadata. Therefore, you should take suitable precautions to protect sensitive data (such as long-lived encryption keys). You should not store sensitive data, such as passwords, as user data.
The EC2 meta data is accessible to any process running on the instance therefore any vulnerability that uses the server to make network requests can access information from the metadata endpoint
This chapter talks about a specific server side vulnerability that allows the user to control a web request that will be made by the server.
Browse to http://publicsite-unique-name.cloudsec.training:8000
This application is vulnerable to a Server Side Request Forgery (SSRF)
A SSRF vulnerability occurs when an application uses user supplied data to make network requests from the webserver (or a different server behind the webserver). An attacker can request internal applications, services, non HTTP ports etc. and retreive information or perform port scans on internal machines or on the Internet.
This application is designed to show if the server health is okay or not.
For example, passing http://127.0.0.1 will fetch the index page of the site running on port 80 which tells us that the server health is okay.
However due to this app being vulnerable to SSRF, internal addresses can also be accessed. Specifically the instance metadata endpoint at http://169.254.169.254:
Try the following URLs
If user meta-data is attached explicitly to the EC2 then this would be found at