# The Red Agent POV: How it Reasoned its Way to SSRF

GitHub-URL-validated ?url= fetcher on GCP Cloud Run accepted `//` absolute-path suffix, enabling unauthenticated local file read of /proc/self/environ GCP credentials and source code.

- Payout: Research
- Severity: critical
- Program: GCP Cloud Run
- Credited: Wiz Research
- Disclosed: 2026-06-17
- Write-up quality: 8/10
- Original: https://www.wiz.io/blog/red-agent-pov-ssrf
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-red-agent-pov-ssrf
- Tags: domain:cloud impact:data-leak impact:internal-access kind:research platform:threat-intel sev:critical tech:gcp technique:chained technique:parser-differential vuln:info-disclosure vuln:path-traversal vuln:ssrf

**Target:** Cloud Run API endpoint /f with ?url= parameter
**Root cause:** Validator only checked the GitHub blob URL prefix while the file-fetch logic treated a trailing `//`-prefixed segment as an absolute local filesystem path, so validator and fetcher parsed the same input differently.
**Steps:**
1. Probe `?url=http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token` — blocked by GitHub host validation
2. Spray traversal variants (`../../../../etc/passwd`, `%2f..%2f`, `%252f..%252f`, `..%00/`, `..%5c`, `..%c0%af`, `....//`) — all blocked
3. Test URL confusion (`github.com@metadata.google.internal`, `github.com#@metadata...`, `github.com.metadata...`, `gcs://`) — all blocked
4. Enumerate real GCP repos (GoogleCloudPlatform/graph-explorer) to fingerprint app
5. Send `?url=https://github.com/x/y/blob/z//proc/self/environ` — returns 4096 bytes of env vars
6. Send `?url=https://github.com/x/y/blob/z//var/task/graph_api.py` — returns 25000 bytes source
**How found:** Reasoned that a URL-fetch parameter on Cloud Run is an SSRF candidate; after metadata and traversal were blocked, inferred the validator parses full URL structure while the fetcher makes real outbound calls and constructs local paths; repo-name injection confirmed local path construction, leading to hypothesis that a `//`-anchored absolute path could satisfy the GitHub prefix check while redirecting the file read locally.
**Exploitation:** Unauthenticated attacker supplies a structurally valid GitHub blob URL with `//` followed by an absolute path; validator passes the prefix, fetcher resolves the trailing absolute path and reads the file, returning contents in the HTTP response. Extracted /proc/self/environ containing live GCP service-account credentials and API keys, plus full application source and bundle.
**Escalation:** Credentials from /proc/self/environ were confirmed valid against live GCP APIs, escalating file read to cloud credential compromise.
**Insight:** When a URL validator enforces a strict prefix but the backend also does local file resolution, try appending `//` plus an absolute path after a valid URL — the `//` acts as an absolute-path anchor that passes prefix validation while the fetcher resolves it as a filesystem root.