SSRF Vulnerabilities: Hardening Cloud Instance Metadata Services

Server-Side Request Forgery (SSRF) is a critical vulnerability that allows an attacker to coerce a server-side application to make HTTP requests to an arbitrary domain. In cloud-native environments (AWS, GCP, Azure), SSRF is frequently exploited to steal IAM credentials from local metadata endpoints.

---

How SSRF Targets Cloud Metadata

Cloud providers host instance metadata services at a standard local loopback IP address: http://169.254.169.254.

The Attack Scenario

An application features a "PDF Generator" that accepts a URL, fetches the page, and converts it to a PDF. An attacker inputs the following URL:

http://169.254.169.254/latest/meta-data/iam/security-credentials/admin-role

The backend server fetches the AWS metadata page internally and renders the response—containing the AWS Access Key, Secret Key, and Session Token—in the PDF returned to the attacker.

---

Remediation & Mitigation

1. Upgrade to IMDSv2 (AWS)

Enforce Instance Metadata Service Version 2 (IMDSv2), which requires session-oriented token requests:

# Require IMDSv2 on EC2 instances
aws ec2 modify-instance-metadata-options --instance-id i-xxxx --http-tokens required

2. Network-Level Restrictions

Block outgoing connections from the application server to the loopback IP using iptables:

iptables -A OUTPUT -d 169.254.169.254 -j REJECT

3. Implement Strict Allow-lists

Avoid parsing user URLs dynamically. If external links must be fetched, match inputs against a strict domain white-list rather than relying on regex black-lists.