T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- scripts/platform_check.py:241
- Finding
- Cloud Instance Metadata Endpoints Are Probed Without Separate Explicit Authorization<![CDATA[ ## Vulnerability Details **File Location**: `scripts/platform_check.py:241-264`; related executable guidance at `references/platform_vulnerabilities_2026.md:412-418` **Vulnerability Type**: Cloud metadata boundary access / excessive capability **Risk Level**: High ### Vulnerable Code ```python def check_aws_metadata(): """检测 AWS 元数据服务""" result = {'service': 'AWS Metadata', 'ip': '169.254.169.254', 'vulnerable': False, 'issues': []} try: import urllib.request req = urllib.request.Request('http://169.254.169.254/latest/meta-data/') urllib.request.urlopen(req, timeout=2) result['status'] = '可访问' result['vulnerable'] = True result['issues'].append('⚠️ AWS 元数据服务可访问，可能存在 SSRF 漏洞') except: result['status'] = '不可访问' return result def check_azure_metadata(): """检测 Azure 元数据服务""" result = {'service': 'Azure Metadata', 'ip': '169.254.169.254', 'vulnerable': False, 'issues': []} try: import urllib.request req = urllib.request.Request('http://169.254.169.254/metadata/instance', headers={'Metadata': 'true'}) urllib.request.urlopen(req, timeout=2) result['status'] = '可访问' result['vulnerable'] = True result['issues'].append('⚠️ Azure 元数据服务可访问') except: result['status'] = '不可访问' return result ``` The reference guide also provides a directly executable metadata request: ```bash echo "=== 云服务元数据检测 ===" curl -s http://169.254.169.254/latest/meta-data/ && echo "⚠️ 元数据可访问" ``` ### Technical Analysis The platform scanner sends HTTP requests to the link-local address `169.254.169.254`, which cloud providers reserve for instance metadata services. This is a sensitive trust boundary because metadata services can expose instance identity information and, through provider-specific identity paths, temporary workload credentials. The current AWS request accesses only the metadata root, while the Azure request accesses i ...[truncated 2085 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove cloud metadata checks from the default `all` scan. 2. Require a dedicated option such as `--cloud-metadata` and display a clear confirmation explaining that the scan will contact a sensitive link-local service. 3. Restrict the check to explicitly authorized cloud instances; do not run it against arbitrary targets or by default. 4. Never enumerate role-name, identity-token, service-account, or credential paths. 5. Do not retain, print, log, or include metadata response bodies in reports. 6. Prefer configuration-based checks: - Verify that AWS IMDSv2 is required. - Verify appropriate metadata hop limits. - Verify that metadata endpoints are disabled where unnecessary. - Verify Azure managed-identity and metadata access controls. 7. Correct the finding language to state that the scanner process can reach metadata. Do not label this as proof of SSRF unless an application-controlled request path is separately tested. 8. Replace the reference guide's direct `curl` command with a guarded procedure that requires authorization and explains the cloud credential risk. 9. Add automated tests confirming that ordinary and `all` scans do not contact `169.254.169.254` unless the explicit metadata option is supplied. ]]>