Simple Scans for Cloud Metadata Service, (Wed, Aug 19th)
A widespread scan targeting the Cloud Instance Metadata Service (IMDS) at 169.254.169.254 is being observed, potentially indicating a broader effort to exploit SSRF vulnerabilities. This service, traditionally used by virtual machines to retrieve machine-specific data, can also be leveraged to steal credentials. Following the Capital One breach, Amazon implemented version 2 of the service, significantly reducing the risk of successful SSRF attacks.
A widespread scan targeting the Cloud Instance Metadata Service (IMDS) at 169.254.169.254 is currently being observed. This service is typically used by virtual machines to retrieve machine-specific data, including information like the region they are running in and their MAC and IP addresses. However, it can also be exploited to retrieve credentials for IAM roles and service account tokens via server-side request forgery (SSRF). Following a significant data leak and subsequent prosecution related to a Capital One breach, Amazon implemented version 2 of the service, which significantly reduced the risk of successful SSRF attacks by requiring more complex requests than a simple ‘GET’ request. The scan being observed appears to be a generic attempt to find vulnerabilities, rather than targeting a specific flaw. The use of link-local addresses, specifically 169.254.169.254, is key to this vulnerability, as these addresses are not routable and are intended for internal communication. A special IPv6 equivalent is fd20:ce::254. The scan utilizes a request like: GET /?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/.
Johannes B. Ullrich, Ph.D. , Dean of Research, SANS.edu