Might have been an SSRF exploit if the WAF was accepting parameter values that were then used to expose IAM credentials via the EC2 metadata service. See https:

Might have been an SSRF exploit if the WAF was accepting parameter values that were then used to expose IAM credentials via the EC2 metadata service. See https://ejj.io/blog/capital-one https://ejj.io/blog/capital-one for a good write-up.