Question

During a web application assessment, you discover that a PDF-generation feature accepts a user-supplied URL and fetches it server-side to render into a document. The application is hosted on an AWS EC2 instance. You submit a URL pointing to an internal address and confirm the server returns the content. Which follow-up request most directly demonstrates the highest-impact exploitation of this flaw?

Accepted Answer

Request http://169.254.169.254/latest/meta-data/iam/security-credentials/ to retrieve the instance role's temporary IAM credentials

Answer

Request http://127.0.0.1:8080/admin to test whether the internal admin panel is reachable

Answer

Request file:///etc/passwd to enumerate local user accounts on the host

Answer

Request http://169.254.169.254/latest/meta-data/instance-id to confirm the instance identifier