flawopen.com/SSRF/Cloud metadata endpoints
SSRF (Server-Side Request Forgery) is when an attacker tricks your server into making a request on their behalf — to a place the attacker couldn't reach directly, but your server can. Cloud metadata endpoints are the highest-value target for this because they hand out real cloud credentials to anything running on the machine that asks, with no authentication.
Major cloud providers expose an internal-only HTTP endpoint (commonly at the address 169.254.169.254) that any process on a cloud instance can query to get information about that instance — including, in many configurations, temporary security credentials for whatever IAM role the instance runs as. This endpoint assumes only the instance's own trusted code would ever ask it — an SSRF vulnerability breaks that assumption, letting an external attacker's request effectively originate "from inside" the trusted network.
SSRF-to-metadata-endpoint has been the root cause of several major, publicly documented cloud breaches — an application accepting a user-supplied URL for some feature (webhook, image proxy, PDF export) that ends up able to reach the metadata endpoint, leaking credentials that grant far broader access than the original vulnerable feature ever should have allowed.
Most major providers use a similar link-local address pattern for this purpose, though the exact path and response format differ — check your specific provider's documentation. Newer metadata service versions (like AWS's IMDSv2) add a required token step specifically to make SSRF exploitation harder.