Detection of SSRF Attempts Targeting Cloud Metadata Services

Attackers frequently exploit server-side request forgery (SSRF) vulnerabilities in web applications to interact with cloud instance metadata services (IMDS). By forcing a web server to make requests to internal-only endpoints such as 169.254.169.254, attackers attempt to retrieve temporary security credentials, identity tokens, and system configuration details associated with the underlying instance role or managed identity. This intelligence highlights the need for robust monitoring of web server access logs for requests containing metadata-related patterns, encoded IP addresses, and specific API paths used by AWS, GCP, and Azure. Successful exploitation allows unauthorized access to cloud resources, privilege escalation, and potential lateral movement within the cloud environment. Defending against this requires identifying the targeted endpoint, verifying if the server responded successfully, and auditing downstream cloud logs for the suspicious use of retrieved credentials.

Attack Chain

1. An attacker identifies a web application endpoint vulnerable to SSRF that accepts user-supplied URLs or query parameters.
2. The attacker crafts a request containing an encoded or direct reference to a cloud metadata service endpoint (e.g., 169.254.169.254).
3. The web server process parses the malicious input and initiates an outbound HTTP request to the internal cloud metadata service.
4. The cloud metadata service responds to the server with sensitive data, including IAM role credentials or instance identity tokens.
5. The web application receives the response and potentially echoes the data back to the attacker or stores it in a location accessible to them.
6. The attacker captures the returned security tokens or credentials.
7. The attacker uses the exfiltrated credentials to authenticate against cloud APIs, gaining unauthorized access to the victim's cloud infrastructure.

Impact

If successful, an SSRF attack leads to the compromise of temporary instance-based credentials. This impact typically manifests as unauthorized access to cloud management consoles, data exfiltration from storage buckets, modification of cloud infrastructure, or the compromise of additional cloud services linked to the affected instance's identity.

Recommendation

Prioritize the implementation of the provided detection logic to identify SSRF attempts against cloud metadata services.

• Deploy the Sigma rules below to your SIEM and tune for your environment to identify requests targeting known metadata IP ranges and paths.
• Use the investigation steps in the rule guidance to correlate detected hits with successful outbound connections from the web server process to internal cloud metadata addresses.
• Enforce IMDSv2 and hop limits on all cloud instances to mitigate the impact of SSRF and prevent unauthorized credential retrieval.
• Implement strict outbound allowlists at the application level to block access to link-local and metadata-specific destinations.