# v1 Instance Metadata Service protections bypass

GCP metadata service's Metadata-Flavor header check bypassed via double-slash, HTTP/1.0, or semicolon URL tricks, exposing service account credentials to SSRF.

- Payout: $5,000
- Severity: medium
- Program: Google
- Credited: Anthony Weems
- Disclosed: 2019-06-14
- Write-up quality: 7/10
- Original: https://lf.lc/vrp/135276622/
- Library page: https://bugbountylibrary.com/r/blog%3Alf-lc-vrp-135276622
- Tags: domain:cloud impact:data-leak impact:internal-access kind:bounty platform:blog sev:medium tech:gcp technique:chained technique:parser-differential vuln:auth-bypass vuln:ssrf

**Target:** GCP Instance Metadata Service (169.254.169.254)
**Root cause:** The metadata service's path/header validation mishandles '//' sequences, HTTP/1.0 requests, and ';' path parameters, allowing requests without the required Metadata-Flavor: Google header to reach metadata endpoints.
**Steps:**
1. `curl 'http://169.254.169.254/computeMetadata//v1/instance/name'` bypasses Metadata-Flavor requirement via extra slash
2. `printf "GET / HTTP/1.0\r\n\r\n" | nc 169.254.169.254 80` dumps all metadata without header
3. `curl -H 'Metadata-Flavor: Google' 'http://169.254.169.254/computeMetadata/v1/instance/name;extra/content'` uses ';' to truncate hardcoded URL suffix
4. Chain with SSRF where URL is partially attacker-controlled: `http://169.254.169.254/computeMetadata//v1/instance/name;yyy`
**How found:** During a client pentest, found an SSRF with partially controlled URL and hardcoded suffix; tested '//' and ';' sequences against the metadata service to see if they bypassed the header check and truncated the suffix.
**Exploitation:** Attacker with an SSRF in a GCP-hosted app sends requests to 169.254.169.254 using '//' or ';' to bypass the Metadata-Flavor header requirement and any hardcoded URL suffix, retrieving service account credentials.
**Escalation:** Chained SSRF with URL-parsing quirks to defeat both header enforcement and hardcoded path suffixes, yielding credential compromise.
**Insight:** When you have partial URL control with a hardcoded suffix, try ';' to truncate the path and '//' to confuse path normalization on the metadata service—both defeated the Metadata-Flavor header check.