4 ms·
At some point though you start making it too hard for legitimate applications and services to make use of the original purpose of the service. IMDSv2 is really
by sylens 4y ago
At some point though you start making it too hard for legitimate applications and services to make use of the original purpose of the service.
IMDSv2 is really aiming to do two things:
1. Require a session to access credentials. You can only initiate the session with a PUT request to prevent some reverse proxy and WAF misconfigurations from becoming the front door. If your reverse proxy still supports PUT requests, IMDSv2 is going to reject anything with an X-Forwarded-For header
2. Once the session is established, it can only be used from the instance where the session began as you get an instance-specific token - so you can't take credentials and then plug them into your own client to start exfiltrating data
- amluto 4y agoReading a value out of /sys/fs/idms/key seems like just the right amount of barrier to entry. Most languages and environments support this out of the box with a line or two of code. Some may treat it as a privileged operation, which is a good thing. Operations like fetch() can only read it if they’re wildly misconducted so they have local filesystem access, which is a rather higher barrier to entry than plain SSRF. And this supports regular file modes and ACLs, whereas getting this right with iptables/nftables is awkward at best and requires enabling a firewall.