A targeted campaign exploited Server-Side Request Forgery (SSRF) vulnerabilities in websites hosted on AWS EC2 instances to extract EC2 Metadata, which could include Identity and Access Management (IAM) credentials from the IMDSv1 endpoint. In the campaign observed by F5, the attackers located websites hosted on EC2 with SSRF flaws, allowing them to remotely query the internal EC2 Metadata URLs and receive sensitive data. The attacks worked because the vulnerable instances were running on IMDSv1, AWS's older metadata service that allows anyone with access to the instance to retrieve the metadata, including any stored IAM credentials. Retrieving IAM credentials allows attackers to escalate their privileges and access S3 buckets or control other AWS services, potentially leading to sensitive data exposure, manipulation, and service disruption. During this time, the attackers rotated six query parameter names (dest, file, redirect, target, URI, URL) and four subpaths (e.g., /meta-data/, /user-data), showing a systematic approach in exfiltrating sensitive data from vulnerable sites. The first malicious SSRF probe was logged on March 13, but the campaign escalated to full scale between March 15 and 25, employing several FBW Networks SAS IPs based in France and Romania. These attacks were highlighted in a March 2025 threat trends report where F5 Labs documented the most exploited vulnerabilities for the past month. Bill Toulas Bill Toulas is a tech writer and infosec news reporter with over a decade of experience working on various online publications, covering open-source, Linux, malware, data breach incidents, and hacks. SSRF problems are web flaws that enable attackers to "trick" a server into making HTTP requests to internal resources on their behalf, which usually are not accessible by the attacker. This metadata service is only accessible by the virtual machine by connecting to special URLs on internal IP addresses, like . EC2 Metadata is a service in Amazon EC2 (Elastic Compute Cloud) that provides information about a virtual machine running on AWS.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Wed, 09 Apr 2025 21:00:19 +0000