# Yahoo Small Business (Luminate) and the Not-So-Secret Keys

Yahoo Luminate's webshots snapshot endpoint fetched arbitrary URLs, letting SSRF reach EC2 metadata and steal IAM role credentials.

- Payout: $9,000
- Severity: critical
- Program: Yahoo! / Verizon Media
- Credited: Tommy DeVoss / dawgyg
- Disclosed: 2017-06-23
- Write-up quality: 8/10
- Original: https://dos.sh/blog/2017/6/21/yahoo-small-business-luminate-and-the-not-so-secret-keys
- Library page: https://bugbountylibrary.com/r/blog%3Ados-sh-blog-2017-6-21-yahoo-small-business-luminate-and-the-not-so-secret-keys
- Tags: domain:cloud domain:web impact:data-leak impact:internal-access kind:bounty platform:blog sev:critical tech:aws technique:recon vuln:secrets-leak vuln:ssrf

**Target:** webshots.luminate.com site snapshot endpoint
**Root cause:** The /tools/site/snapshot/desktop endpoint took a user-supplied url param and made a server-side GET to it to render a screenshot, without blocking the EC2 link-local metadata address 169.254.169.254.
**Steps:**
1. Request `https://webshots.luminate.com/tools/site/snapshot/desktop?url=http://169.254.169.254/latest/meta-data/`
2. Observe rendered image listing metadata paths
3. Request `...?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/` to see role name `Ec2LeastPrivileged`
4. Request `...?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/Ec2LeastPrivileged` to render the AccessKeyId/SecretAccessKey/Token as an image
**How found:** @zlz noticed an image loaded during checkout pointing at the snapshot endpoint; they probed localhost/private IPs (blocked) and SVG XSS (failed). At an AWS Summit talk, the metadata IP 169.254.169.254 was shown and matched an IP they had been testing, prompting them to try it against the SSRF.
**Exploitation:** Attacker supplies the EC2 metadata URL as the url param; the server fetches it and returns the response rendered as a JPEG, disclosing temporary IAM credentials for the Ec2LeastPrivileged role.
**Insight:** When an SSRF blocks localhost/127.0.0.1, still try the cloud link-local metadata IP 169.254.169.254 (and its IAM credentials path) — filters often block loopback but forget metadata addresses.