Curl-url-http-3a-2f-2f169.254.169.254-2flatest-2fapi-2ftoken [COMPLETE · Manual]
I notice you've shared what appears to be a URL encoded string that decodes to:
If an attacker finds a Server-Side Request Forgery (SSRF) in a web application hosted on AWS, they might attempt to: curl-url-http-3A-2F-2F169.254.169.254-2Flatest-2Fapi-2Ftoken
discovered they could trick web applications into sending requests for them—an attack called Server-Side Request Forgery (SSRF) I notice you've shared what appears to be
In the landscape of cloud computing, the Instance Metadata Service (IMDS) serves as a critical source of configuration data for virtual machines. However, it has also become a primary vector for privilege escalation attacks, specifically through Server-Side Request Forgery (SSRF). This paper examines the transition from IMDSv1 to IMDSv2, focusing on the token retrieval mechanism accessed via the encoded endpoint curl-url-http-3A-2F-2F169.254.169.254-2Flatest-2Fapi-2Ftoken . We analyze the security architecture of IMDSv2, the necessity of the X-aws-ec2-metadata-token header, and the persistence of legacy vulnerabilities in containerized environments. Instance Launch : When an instance is launched
Part 1: What Is 169.254.169.254?
only fetches the token
However, the simplified command in your keyword: curl http://169.254.169.254/latest/api/token — , not the credentials themselves. Still, in a real attack, once the attacker has this token, they can use it to fetch IAM credentials.
First, request a token using PUT :
curl -H "X-aws-ec2-metadata-token: YOUR_TOKEN_HERE" http://169.254.169.254/latest/meta-data/instance-id
- Instance Launch: When an instance is launched in AWS, it is assigned a unique instance ID and IP address.
- Metadata Service Access: The instance can access the metadata service via the special URL
http://169.254.169.254/latest/meta-data/. - Retrieve Metadata: The instance can retrieve metadata about itself, such as its ID, type, and IP address.
- Retrieve Temporary Security Credentials: The instance can use the metadata service to retrieve temporary security credentials, which can be used to access other AWS resources.
