# SSRF in webhooks leads to AWS private keys disclosure

Webhook redirect handling followed HTTP 303 responses, letting an attacker SSRF the EC2 metadata endpoint and read AWS IAM credentials for aws-opsworks-ec2-role.

- Payout: hidden
- Severity: high
- Program: Omise
- Found by: honoki
- Disclosed: 2019-06-28
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/508459
- Library page: https://bugbountylibrary.com/r/h1%3A508459
- Tags: area:cloud domain:cloud domain:web impact:data-leak impact:internal-access kind:bounty platform:hackerone sev:high tech:aws technique:source-review vuln:ssrf

**Target:** Webhook delivery endpoint on dashboard.omise.co
**Root cause:** Webhook fetcher blocked normal redirects but still followed HTTP 303 See Other responses, allowing attacker-controlled redirect to arbitrary internal URLs including the EC2 metadata service.
**Steps:**
1. Host `<?php header('Location: http://169.254.169.254/latest/meta-data/iam/security-credentials/aws-opsworks-ec2-role', TRUE, 303); ?>` on attacker server.
2. Set webhook endpoint at https://dashboard.omise.co/test/webhooks/edit to the attacker URL.
3. Trigger a webhook by making an API call, e.g. adding a user.
4. Open Recent Deliveries at https://dashboard.omise.co/test/webhooks; observe 200 OK on the redirect.
5. Click the event to read the AWS metadata response body containing credentials.
**How found:** Observed that webhooks generally do not follow redirects, then tested whether specific redirect status codes bypass that restriction; a 303 See Other was followed, revealing the SSRF primitive.
**Exploitation:** Attacker registers a webhook pointing to their server, which returns a 303 redirect to the EC2 metadata URL. When Omise's server delivers the webhook it follows the 303 and fetches the metadata endpoint, and the response body is stored and viewable in the dashboard's Recent Deliveries, disclosing IAM credentials for aws-opsworks-ec2-role.
**Escalation:** Metadata credentials grant access to the AWS environment; SSRF also enables internal network enumeration and access to internal services.
**Insight:** When a fetcher blocks redirects, test each 3xx status individually (301/302/303/307/308) — filters often only cover the common 301/302, and 303 is frequently missed.