Skip to content
attack.paths
Sign in
← RegistryDossier · 6 steps · 5 edges

SSRF → IMDS → cloud creds → lateral

An image-fetcher / link-preview endpoint fetches attacker-controlled URLs server-side. Pivot to the cloud metadata service and steal the instance role credentials.

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: app runs on EC2 / GCE / Azure VM with an attached instance/managed identity. IMDS v1 is enabled (or IMDSv2 with no hop-limit hardening).

§ Steps

  1. 01
    Pivot via cloud APIs (S3, KMS, SSM)Initial Access
    T1078— Valid Accounts
  2. 02
    AWS / Azure / GCP CLI enumerationDiscovery
    T1087— Account Discovery
  3. 03
    Steal IAM role / managed-identity credsCredential Access
    T1552— Unsecured Credentials
  4. 04
    Find URL-fetcher endpointReconnaissance
    W-RECON-API-DISCO— API Endpoint Discovery
  5. 05
    Confirm SSRFLateral Movement
    W-SSRF— Server-Side Request Forgery (SSRF)

    Burp Collaborator / interactsh callback.

  6. 06
    Hit 169.254.169.254 / metadata.google.internalLateral Movement
    W-SSRF-IMDS— SSRF → Cloud IMDS

§ References

§ Frequently asked

What is the "SSRF → IMDS → cloud creds → lateral" attack path?
An image-fetcher / link-preview endpoint fetches attacker-controlled URLs server-side. Pivot to the cloud metadata service and steal the instance role credentials. It chains 6 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is Pivot via cloud APIs (S3, KMS, SSM) (T1078) — a initial access primitive. Assumed environment: app runs on EC2 / GCE / Azure VM with an attached instance/managed identity.
What is the final impact of this kill-chain?
The final step lands on Hit 169.254.169.254 / metadata.google.internal (W-SSRF-IMDS), which falls under Lateral Movement. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers