Widespread Scans Target Cloud Metadata Service for Credentials via SSRF
Attackers are broadly scanning for Server-Side Request Forgery (SSRF) vulnerabilities to access cloud providers' metadata services and steal sensitive information like IAM credentials.
Cloud environments are facing a new wave of automated scanning activity targeting a critical attack vector: the instance metadata service. This service, typically accessible at the link-local address 169.254.169.254, provides virtual machines with access to sensitive data, including identity and access management (IAM) credentials and service account tokens. While not directly accessible from the public internet, attackers can exploit Server-Side Request Forgery (SSRF) vulnerabilities within cloud applications to trick a server into making requests to this internal endpoint.
The specific IP address 169.254.169.254 is part of the 169.254/16 range, defined by RFC 3927 as link-local addresses. These addresses are intentionally non-routable, making them ideal for services that need to be accessible from within a machine but must never be forwarded by network routers. This design prevents external attackers from directly reaching the metadata service, forcing them to rely on application-level flaws like SSRF to gain access.
The Capital One breach in 2019, which resulted in a massive data leak, famously leveraged the cloud instance metadata service. Following this incident, cloud providers, including AWS, implemented security enhancements. For instance, AWS introduced Version 2 of its metadata service, which requires a specific PUT request to initiate a session, making simple GET requests insufficient for credential retrieval and significantly hardening the service against basic SSRF attacks.
However, the recent widespread scanning activity observed by the SANS Internet Storm Center suggests that attackers are not targeting a specific, known vulnerability. Instead, they appear to be broadly probing applications for *any* SSRF flaw that could lead to the metadata service. The observed scan requests, such as GET /?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/ HTTP/1.1, indicate a generic attempt to find and exploit such weaknesses.
This broad-spectrum approach highlights a persistent threat to cloud-hosted applications. Even with improved security measures on the metadata service itself, the underlying vulnerability of SSRF in web applications remains a significant risk. Attackers are likely hoping to find misconfigured applications or older systems that have not yet adopted the more secure metadata service versions or implemented proper SSRF defenses.
Organizations operating in cloud environments, particularly those utilizing AWS, Google Cloud, Azure, or other major providers, must prioritize securing their applications against SSRF vulnerabilities. This includes implementing robust input validation, using allowlists for external requests, and ensuring that internal services like the metadata endpoint are not inadvertently exposed through application logic flaws.
Furthermore, staying updated on cloud security best practices and regularly auditing application configurations are crucial. The continued exploitation of the metadata service, as evidenced by these widespread scans, underscores the ongoing need for vigilance and proactive security measures in cloud infrastructure to protect sensitive credentials and prevent data breaches.