flawopen.com/安全事件/Capital One SSRF
银行有一位专门替客户去指定地点取回信件的跑腿员。而在银行内部走廊尽头，有一间没有挂牌的内勤室，只要有人敲门就向其发放整栋大厦的总钥匙。一位心怀不轨的访客吩咐跑腿员去走廊尽头敲门取件，跑腿员照办，并把整栋大厦的万能钥匙原封不动交给了访客。
Capital One is the reason SSRF stopped being treated as a second-tier bug class. Before it, SSRF was often triaged as an information-disclosure nuisance. After it, the industry understood that in a cloud environment SSRF is a credential-theft primitive — because the cloud platform itself puts a credential vending machine at a fixed, well-known, unauthenticated address inside every instance.
AWS introduced IMDSv2 in November 2019, requiring a PUT to obtain a session token and defaulting to a low IP hop limit. Both changes specifically break the "one blind GET" pattern this attack relied on. Equivalent hardening exists across other cloud providers.
169.254.169.254 is defeated by decimal encodings, DNS names that resolve to it, and redirects. Resolve, then check the address range.No — it removes one very high-value target. SSRF can still reach internal admin interfaces, databases, Kubernetes APIs, and other services that trust the network position of the caller. It remains a serious bug class on its own merits.
The vulnerable component in this case was a web application firewall, which is a useful reminder that security appliances are applications too. Filtering rules can raise the cost of exploitation but do not address the underlying design, which is that a server will fetch whatever address it is told to.