# ESEA Server-Side Request Forgery and Querying AWS Meta Data

media_preview.php fetched arbitrary URLs server-side; appending ?.png bypassed the image-extension check, enabling SSRF to AWS metadata (169.254.169.254) and stored XSS.

- Payout: $1,000
- Severity: high
- Program: ESEA
- Credited: Brett Buerhaus
- Disclosed: 2016-04-18
- Write-up quality: 7/10
- Original: https://buer.haus/2016/04/18/esea-server-side-request-forgery-and-querying-aws-meta-data/
- Library page: https://bugbountylibrary.com/r/blog%3Abuer-haus-2016-04-18-esea-server-side-request-forgery-and-querying-aws-meta-data
- Tags: domain:web impact:data-leak impact:internal-access kind:bounty platform:blog sev:high tech:aws technique:chained technique:recon vuln:ssrf vuln:xss

**Target:** PHP image-preview endpoint on play.esea.net
**Root cause:** The url parameter was fetched server-side with only a naive extension check on the URL string; the check looked at text after the last dot, so a trailing ?.png made any URL pass while the fetched body was still returned.
**Steps:**
1. Google dork `site:https://play.esea.net/ ext:php` to enumerate endpoints; note `media_preview.php?url=`.
2. Confirm fetch: `?url=http://ziot.org/1.png` returns your image; plain `?url=http://ziot.org/` fails (extension check).
3. Bypass extension check: `?url=http://ziot.org/?.png` returns full body of any URL.
4. Test wrappers `file://`, `php://filter` — blocked; assume http-only.
5. Point at AWS metadata: `?url=http://169.254.169.254/latest/meta-data/` and subpaths like `/latest/meta-data/iam/security-credentials/` to read instance/account data.
6. For XSS, host an HTML file with a JS payload and load it via the endpoint; it renders in play.esea.net origin.
**How found:** Recon via Google dorking surfaced media_preview.php; hypothesis that it fetches user-supplied URLs. Initial fetch of own server failed, but an image URL succeeded, revealing an extension check. Guessing the check parsed text after the last dot, appending `?.png` bypassed it. NahamSec suggested querying the AWS metadata IP once http-only was confirmed.
**Exploitation:** Attacker supplies any http URL to media_preview.php; server fetches it and returns the body to the attacker's browser. By targeting the link-local metadata IP 169.254.169.254, the attacker reads EC2 instance metadata including IAM role credentials, yielding AWS API access to ESEA's account.
**Escalation:** SSRF to AWS IMDS pivots from a web endpoint to cloud account compromise via IAM role credential theft; same endpoint also yields XSS in the ESEA origin.
**Insight:** When an SSRF endpoint enforces a file-extension check, try appending `?.png` (or `#.png`) so the parser sees an image extension while the actual request path stays arbitrary; then pivot to 169.254.169.254 for IAM credentials.