EC2's most dangerous feature

Re:EC2's most dangerous feature by cddotdotslash on Sunday October 09, 2016 @04:25PM (#12673260)

This is actually a vulnerability I've seen countless times. If a site accepts a URL which it reads and returns to the user, submit the 169.254.169.254 metadata service. About 1 out of 5 times I've tried it, I'm about to get a response.

[ Parent | on HN ]

Re:EC2's most dangerous feature by stevekemp on Monday October 10, 2016 @09:51AM (#12677061)

I think that's another example of bad filtering, same thing that happens if you accept an URL and don't disallow `file:///etc/passwd`.

[ Parent | on HN ]

Re:EC2's most dangerous feature by startling on Sunday October 09, 2016 @07:07PM (#12674058)

Sometimes you can do this with things like smtp servers as well.

[ Parent | on HN ]