flawopen.com/Инциденты/Capital One SSRF
Курьер компании готов сходить за посылкой по любому адресу. Внутри охраняемого здания есть потайная дверь, где выдают мастер-ключи от сейфов каждому, кто постучит. Злоумышленник просит курьера постучать в эту внутреннюю дверь — и курьер выносит ключи наружу.
Capital One is the reason SSRF stopped being treated as a second-tier bug class. Before it, SSRF was often triaged as an information-disclosure nuisance. After it, the industry understood that in a cloud environment SSRF is a credential-theft primitive — because the cloud platform itself puts a credential vending machine at a fixed, well-known, unauthenticated address inside every instance.
AWS introduced IMDSv2 in November 2019, requiring a PUT to obtain a session token and defaulting to a low IP hop limit. Both changes specifically break the "one blind GET" pattern this attack relied on. Equivalent hardening exists across other cloud providers.
169.254.169.254 is defeated by decimal encodings, DNS names that resolve to it, and redirects. Resolve, then check the address range.No — it removes one very high-value target. SSRF can still reach internal admin interfaces, databases, Kubernetes APIs, and other services that trust the network position of the caller. It remains a serious bug class on its own merits.
The vulnerable component in this case was a web application firewall, which is a useful reminder that security appliances are applications too. Filtering rules can raise the cost of exploitation but do not address the underlying design, which is that a server will fetch whatever address it is told to.