Webhook-url-http-3a-2f-2f169.254.169.254-2fmetadata-2fidentity-2foauth2-2ftoken
This URL represents a vulnerability and should not be used as a legitimate feature.
If successful, the application will return the OAuth2 access token to the attacker. With this token, the attacker can act as the VM and access sensitive resources in the Azure subscription, such as databases or storage accounts. 3. High-Risk Target
This public link is valid for 7 days and shares a thread, including any personal information you added. This link or copies made by others cannot be deleted. If you share with third parties, their policies apply. Can’t copy the link right now. Try again later.
# From inside an Azure VM with Managed Identity enabled curl 'http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/' -H 'Metadata: true' This URL represents a vulnerability and should not
def is_safe_webhook_url(raw_url): # Decode percent-encoding first decoded_url = unquote(raw_url) parsed = urlparse(decoded_url)
: The vulnerable application server processes the request. Because the request originates inside the server, the server queries its own local link-local IP ( 169.254.169.254 ).
Never allow user-supplied input to dictate the URL in an HTTP request. If you share with third parties, their policies apply
Methods to for the managed identity to minimize security risks.
An explicit example of this risk is embedded in the string: webhook-url-http-3A-2F-2F169.254.169.254-2Fmetadata-2Fidentity-2Foauth2-2Ftoken .
: If you are testing a "Webhook" or "URL Preview" feature, inputting this URL is a common method to test for Server-Side Request Forgery (SSRF) Data Exposure or key vaults
response = requests.post(event_data['webhook'], json=payload)
Never allow requests to the Link-Local address range ( 169.254.x.x ).
Which (Azure, AWS, or GCP) does your primary application run on?
If the compromised server has a Managed Identity allowing it to read database strings, storage blobs, or key vaults, the attacker gains instant access to that sensitive data.
