Unauthenticated SSRF reaching cloud metadata.
Endpoints that fetch a user-supplied URL could be pointed at the cloud provider's internal metadata service.
- Discovered (complete)
- Proven (complete)
- Fixed (not yet published)
- Retested (not yet published)
What they were shipping
Multi-tenant developer tooling with webhook and document-link features.
What we found
Endpoints that accept a webhook URL or a document link fetched the remote resource from the backend without validating the destination IP range.
How we proved it
An unauthenticated request pointed the server at the cloud provider's internal metadata service and private address ranges.
Business impact
Instance IAM credentials, container environment variables and internal services never meant to face the internet were within reach.
Fix
Resolve the destination yourself, reject private, loopback and link-local ranges on every resolved address, and connect to the address you validated.
Retest
Retest status not published for this case.
Why it keeps happening
If your backend fetches user-supplied URLs, a scanner won't tell you whether the worker blocks internal addresses. We found this three times in one month, always unauthenticated.