Cloud Infrastructure
Metadata Service Abuse (SSRF)
Server-side request forgery turns a web vulnerability into cloud credential theft.
What it is
Cloud instance metadata services (AWS IMDSv1, Azure IMDS) return IAM credentials when queried from the instance. A server-side request forgery (SSRF) vulnerability in any application running on the instance can be used to query the metadata service from an external request — retrieving temporary credentials without authentication. IMDSv2 mitigates this for AWS but is not enforced by default.
Attack techniques
- SSRF to cloud metadata service (T1552.005)
- IMDSv1 credential extraction
- Azure IMDS token theft
- GCP metadata server abuse
Business impact
Credentials retrieved from the metadata service have the same permissions as the instance role. This turns any SSRF in a web application into cloud infrastructure access.