BERRY9 IT Services, home +91 86868 92922

SSRF in the Cloud Era: Exploiting IMDS and Beyond

Server-Side Request Forgery (SSRF) joined the OWASP Top 10 in 2021 — and for good reason. In a cloud-native deployment, an SSRF that can reach the instance metadata service hands the attacker the IAM role of the host. From there it is usually a short walk to the entire account.

Request a scoping call Call +91 86868 92922

Web applications · By Thimmagurudu Bathini · Published · 7 min read · Last reviewed

The classic vector

Updated November 2026: in the OWASP Top 10:2025, SSRF no longer has its own entry and is part of Broken Access Control (A01). Our summary of the 2025 changes explains why. The attack itself is unchanged.

Any feature that fetches a URL on the server's behalf is a candidate: image proxies, document converters, webhook senders, OAuth callback handlers, profile picture fetchers, PDF generators, RSS readers. The payload to test for AWS IMDSv1 is the same as it has been for years:

http://169.254.169.254/latest/meta-data/iam/security-credentials/

If the response is the role name, the attacker fetches the credentials at that path next, and the account is compromised. IMDSv2 (token-based) blocks this for hosts that have it enforced — most deployments still permit IMDSv1 fallback.

Bypassing weak filters

Common filters block 169.254.169.254 by string match. They miss decimal (http://2852039166), octal, IPv6-mapped, DNS rebinding, and CIDR-edge addresses.

Beyond AWS

  • GCP — http://metadata.google.internal/computeMetadata/v1/ with header Metadata-Flavor: Google
  • Azure — http://169.254.169.254/metadata/identity/oauth2/token with Metadata: true
  • Kubernetes — the API server at https://kubernetes.default.svc from inside a pod
  • Internal services — Redis, Elasticsearch, internal admin panels reachable on RFC1918 ranges

Defenses

Enforce IMDSv2 on every EC2 instance. Block egress to metadata IPs at the application or sidecar layer. Use an HTTP client that resolves DNS once, validates the IP against an allowlist, and follows redirects only to allowlisted hosts. Our network and infrastructure engagement covers metadata exposure as part of the cloud surface walk.

Written by Thimmagurudu Bathini, BERRY9 IT SERVICES PRIVATE LIMITED, Hyderabad. Questions about your own systems? Request a scoping call or call +91 86868 92922.

Plan your next security test

Tell us what needs testing and when you need it done, and we will propose a scope and timeline. We respond within 24 hours. If you would rather talk first, call or write to us.

Request a scoping call WhatsApp