They are asking for your cloud keys
Five hundred and thirty-two web requests in one week carried a link-local cloud metadata address inside a query parameter, url-encoded so it reads as noise in a log. Decoded, it is an instruction to the server: fetch this address and hand back what it returns. On a cloud instance that address answers with temporary identity credentials. Off one it answers with nothing, which is why the same probe is sprayed at every address that responds.
Five hundred and thirty-two requests this week asked the server to go and fetch its own cloud credentials.
In a log it looks like noise. A parameter full of percent signs and hex, too ugly to read, so nobody reads it.
Decode it and the meaning is plain. It is an address handed to the server as a parameter, with the instruction to fetch it and hand back whatever comes.
The address is link-local. It only answers from inside a cloud instance, and what it answers with is the temporary identity that instance runs as.
Nothing here runs in a cloud, so it returns nothing. That is why the probe keeps coming: asking costs nothing, and it only has to work once.
The flaw being hunted is not in the cloud. It is any place your code fetches a link somebody else supplied.
If it takes a link from a user, it needs an allowlist.
#linux#security#selfhosted#infosec#cloud
❯ If it takes a url from a user, it needs an allowlist.