# SSRF to cloud metadata endpoints

Server-side URL fetch reaching 169.254.169.254 or private ranges, leaking cloud credentials

_Area: Web infrastructure and server-side requests. Seen in 22 disclosed reports; 11 confirmed bounties, median $3,500, range $250-$31,337; latest 2026-10-02. Updated 2026-10-23._

## How it works
A server takes a URL (or host/port) from the user and fetches it itself. The code assumes the destination is a public web resource, but the server sits inside a trusted network where link-local and private addresses are reachable. The classic target is the cloud metadata endpoint at 169.254.169.254, which answers unauthenticated requests from the instance and returns credentials. The assumption that breaks: "the user can only point us at things they could reach anyway." They cannot reach the metadata IP; the server can.

## Where it shows up
- Any parameter that becomes a server-side GET: image/snapshot/screenshot URLs, webhook and callback URLs, import/fetch features, uptime checks [E1](https://bugbountylibrary.com/r/blog%3Anechudav-blogspot-com-2020-11-31k-ssrf-in-google-cloud-monitoring-html.md)[E2](https://bugbountylibrary.com/r/blog%3Ados-sh-blog-2017-6-21-yahoo-small-business-luminate-and-the-not-so-secret-keys.md)[E6](https://bugbountylibrary.com/r/h1%3A3623149.md)[E7](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-advisory-jamf-pro-ssrf-cve-2021-39303-cve-2021-40809.md)[E8](https://bugbountylibrary.com/r/blog%3Akuldeep-io-posts-holiday-hunting-with-aquatone.md).
- Custom headers on the outbound request: GCE v1 metadata needs `Metadata-Flavor: Google`, and a feature letting users set headers supplies it [E1](https://bugbountylibrary.com/r/blog%3Anechudav-blogspot-com-2020-11-31k-ssrf-in-google-cloud-monitoring-html.md)[E8](https://bugbountylibrary.com/r/blog%3Akuldeep-io-posts-holiday-hunting-with-aquatone.md).
- Filters that block `localhost`/`127.0.0.1` but not `169.254.169.254` or `10.0.0.0/8` [E2](https://bugbountylibrary.com/r/blog%3Ados-sh-blog-2017-6-21-yahoo-small-business-luminate-and-the-not-so-secret-keys.md)[E4](https://bugbountylibrary.com/r/h1%3A333419.md).
- Non-HTTP relays: TURN/STUN `XOR-PEER-ADDRESS`, provisioner parameters like `resturl` passed to internal clients [E3](https://bugbountylibrary.com/r/h1%3A776017.md)[E4](https://bugbountylibrary.com/r/h1%3A333419.md)[E5](https://bugbountylibrary.com/r/h1%3A843256.md).
- Callback URLs validated at registration but used unvalidated at send time [E6](https://bugbountylibrary.com/r/h1%3A3623149.md).

## How to review
Find every outbound-request sink (shared HTTP client wrappers, screenshot renderers, provisioner clients) and trace callers up to request parameters [E7](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-advisory-jamf-pro-ssrf-cve-2021-39303-cve-2021-40809.md). The invariant: the destination must be resolved and checked against an allowlist of public addresses, rejecting link-local, loopback and private ranges. Re-check after every redirect and after DNS resolution (rebinding), and confirm the check lives at the sink, not only at the controller or at registration time [E6](https://bugbountylibrary.com/r/h1%3A3623149.md). The allowlist must also cover IPv6 (`fe80::`, `::1`, `fc00::/7`) and alternate encodings (decimal, octal, hex) of the same addresses. For non-HTTP relays, inspect peer-address handling separately: confirm peer addresses are restricted to public IPs and loopback/multicast peers are disabled [E4](https://bugbountylibrary.com/r/h1%3A333419.md)[E5](https://bugbountylibrary.com/r/h1%3A843256.md).

## Variants seen
- Full-read SSRF returning the response body base64-encoded [E7](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-advisory-jamf-pro-ssrf-cve-2021-39303-cve-2021-40809.md).
- Blind SSRF turned into a boolean "response contains X" oracle [E1](https://bugbountylibrary.com/r/blog%3Anechudav-blogspot-com-2020-11-31k-ssrf-in-google-cloud-monitoring-html.md).
- Internal-network fetcher reachable only from inside the vendor VPC, missing the allowlist check at the sink [E3](https://bugbountylibrary.com/r/h1%3A776017.md).
- Metadata reachable despite loopback blocking [E2](https://bugbountylibrary.com/r/blog%3Ados-sh-blog-2017-6-21-yahoo-small-business-luminate-and-the-not-so-secret-keys.md).
- SSRF from controller-manager via provisioner parameters, with CRLF and redirect handling widening the request [E3](https://bugbountylibrary.com/r/h1%3A776017.md).
- TURN relay proxying TCP/UDP to metadata and private ranges (protocol-level, not HTTP) [E4](https://bugbountylibrary.com/r/h1%3A333419.md)[E5](https://bugbountylibrary.com/r/h1%3A843256.md).
- Screenshot app exposing raw response via a "view JSON" feature, plus a JSON-decode error oracle for port scanning [E8](https://bugbountylibrary.com/r/blog%3Akuldeep-io-posts-holiday-hunting-with-aquatone.md).

## Impact and severity
Leads to cloud credential theft and internal pivoting; high to critical. Worse when the full response is returned [E7](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-advisory-jamf-pro-ssrf-cve-2021-39303-cve-2021-40809.md)[E8](https://bugbountylibrary.com/r/blog%3Akuldeep-io-posts-holiday-hunting-with-aquatone.md), when the endpoint is unauthenticated [E1](https://bugbountylibrary.com/r/blog%3Anechudav-blogspot-com-2020-11-31k-ssrf-in-google-cloud-monitoring-html.md), and when the metadata role is broadly privileged [E1](https://bugbountylibrary.com/r/blog%3Anechudav-blogspot-com-2020-11-31k-ssrf-in-google-cloud-monitoring-html.md)[E2](https://bugbountylibrary.com/r/blog%3Ados-sh-blog-2017-6-21-yahoo-small-business-luminate-and-the-not-so-secret-keys.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Anechudav-blogspot-com-2020-11-31k-ssrf-in-google-cloud-monitoring-html.md
- E2: https://bugbountylibrary.com/r/blog%3Ados-sh-blog-2017-6-21-yahoo-small-business-luminate-and-the-not-so-secret-keys.md
- E3: https://bugbountylibrary.com/r/h1%3A776017.md
- E4: https://bugbountylibrary.com/r/h1%3A333419.md
- E5: https://bugbountylibrary.com/r/h1%3A843256.md
- E6: https://bugbountylibrary.com/r/h1%3A3623149.md
- E7: https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-advisory-jamf-pro-ssrf-cve-2021-39303-cve-2021-40809.md
- E8: https://bugbountylibrary.com/r/blog%3Akuldeep-io-posts-holiday-hunting-with-aquatone.md