!!link!! — Webhook-url-http-3a-2f-2f169.254.169.254-2fmetadata-2fidentity-2foauth2-2ftoken
Do not allow arbitrary IPs. Only allow outbound requests to known SaaS vendor IPs (e.g., slack.com , github.com ). Never allow 169.254.0.0/16 .
Stay safe, and always validate your webhooks.
: If you are testing a "Webhook" or "URL Preview" feature, inputting this URL is a common method to test for Server-Side Request Forgery (SSRF) Data Exposure
Webhooks are designed to send data to a URL provided by a user. The danger arises when an application takes that user-supplied URL and blindly makes a request to it. Do not allow arbitrary IPs
Attackers cannot directly talk to 169.254.169.254 from their laptop. That IP is blocked by the internet. But if your application has a vulnerability, attackers can trick your server into making the request for them.
If a VM or container doesn’t need to access Azure AD-protected resources, . For those that do, assign the least privilege possible (e.g., a read-only role for a specific storage container, not Contributor on the subscription).
While incredibly useful, this endpoint is a high-value target for attackers, specifically in attacks. Stay safe, and always validate your webhooks
If you are seeing this URL in a "webhook" context, it usually indicates one of two things: a legitimate integration for cloud identity or a vulnerability being tested. 🛠️ Legitimate Use Cases
At first glance, webhook-url-http-3A-2F-2F169.254.169.254-2Fmetadata-2Fidentity-2Foauth2-2Ftoken looks like a mess of percent-encoding and hyphens. Let’s decode it step by step.
: The attacker can use this token from their own laptop to log into the victim's Azure environment with the same permissions as the compromised VM. How to Protect Your Environment Attackers cannot directly talk to 169
http://169.254.169.254/metadata/identity/oauth2/token is a sensitive endpoint within the Azure Instance Metadata Service (IMDS) used to retrieve OAuth2 access tokens for a virtual machine's Managed Identity
Note on Microsoft Azure SSRF Mitigations. In 2020, Microsoft implemented several measures to mitigate the impact of SSRF attacks o... Orca Security
http://169.254.169.254/metadata/identity/oauth2/token
If an attacker provides http://169.254.169.254/metadata/identity/oauth2/token as their "webhook destination," your server may dutifully reach out to that internal address. Because the request comes from within your cloud network, the metadata service trusts it and may return a . The Potential Impact:
