flawopen.com/Incidentes/Capital One SSRF
Una empresa tiene un conserje que recoge documentos de cualquier dirección que le des. Dentro de la sede hay una ventanilla oculta que entrega las llaves maestras del banco a quien pregunte. Le pides al conserje que vaya a esa ventanilla interna y te traiga las llaves: como es una dirección más, el conserje te las entrega.
Capital One is the reason SSRF stopped being treated as a second-tier bug class. Before it, SSRF was often triaged as an information-disclosure nuisance. After it, the industry understood that in a cloud environment SSRF is a credential-theft primitive — because the cloud platform itself puts a credential vending machine at a fixed, well-known, unauthenticated address inside every instance.
AWS introduced IMDSv2 in November 2019, requiring a PUT to obtain a session token and defaulting to a low IP hop limit. Both changes specifically break the "one blind GET" pattern this attack relied on. Equivalent hardening exists across other cloud providers.
169.254.169.254 is defeated by decimal encodings, DNS names that resolve to it, and redirects. Resolve, then check the address range.No — it removes one very high-value target. SSRF can still reach internal admin interfaces, databases, Kubernetes APIs, and other services that trust the network position of the caller. It remains a serious bug class on its own merits.
The vulnerable component in this case was a web application firewall, which is a useful reminder that security appliances are applications too. Filtering rules can raise the cost of exploitation but do not address the underlying design, which is that a server will fetch whatever address it is told to.