# Full read SSRF at █████████ [HtUS]

LRS configuration URL field in DoD product portal fetched arbitrary URLs, letting an authenticated user read AWS EC2 metadata via the test-log download.

- Payout: hidden
- Severity: high
- Program: U.S. Dept Of Defense
- Found by: sudi
- Disclosed: 2022-09-14
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1628102
- Library page: https://bugbountylibrary.com/r/h1%3A1628102
- Tags: area:web domain:web impact:data-leak impact:internal-access kind:bounty platform:hackerone sev:high tech:aws technique:chained vuln:ssrf

**Target:** Web app LRS configuration / xAPI test endpoint
**Root cause:** User-supplied LRS URL is fetched server-side by the xAPI test feature without restricting internal/metadata addresses; the trailing '?' tricks path handling into appending /statements to the metadata path.
**Steps:**
1. Register and verify account at `/users/create`
2. Create a product at `/products/create/`
3. Click `New Configuration` under LRS Configurations
4. Set LRS URL to `http://<metadata-ip>/latest/meta-data?` (trailing `?` required)
5. Set Basic Auth user/pass to `test`/`test`, create config
6. Click `Test` beside the configuration
7. Return to product page, open `Past Results` > `Manage Test record` > `Download log`
8. Check `Include HTTP`, choose Plain text, download `log` and read metadata response
**How found:** Not stated; likely noticed the LRS URL is fetched server-side and tried the metadata endpoint, using a trailing `?` to neutralize the appended `/statements` path.
**Exploitation:** Authenticated user supplies internal URL as LRS endpoint; the server's xAPI test POSTs to `<url>/statements` and the response is captured in the downloadable test log, exfiltrating EC2 metadata (ami-id, hostname, identity-credentials, etc.).
**Escalation:** Metadata listing exposes `identity-credentials/` and `public-keys/`, enabling IAM credential theft and internal host reach.
**Insight:** When a feature appends a fixed path (e.g. `/statements`) to your URL, a trailing `?` turns the suffix into a query string, preserving the metadata path; then look for a log/response viewer to read the fetched body.