H1 #508459 is the cheapest version of the chain to reproduce. Omise's webhook URL parameter accepted an arbitrary host, the researcher pointed it at an intermediary that answered with an HTTP 303 to the metadata credentials path, and the platform followed the redirect [12]. H1 #643278 removes the last comfort: a Dynatrace custom integration endpoint reached the same outcome blind, with no response body handed back to the attacker [13]. In both cases the validator saw only the first hop, and the first hop was a host the attacker owned.
That is why the metadata mode carries the severity rather than the code. IMDSv1 hands over AccessKeyId, SecretAccessKey and a Token valid for hours on one unauthenticated GET [7]. Getting the same object under v2 means first issuing a PUT with X-aws-ec2-metadata-token-ttl-seconds, then replaying the token it returns [8]. A server-side fetcher built to GET a user-supplied URL with fixed headers cannot do either step, which is the whole of v2's protection and also the shape of its limit: a gadget that lets the caller choose method and headers, such as a proxy endpoint or an HTTP client exposed through configuration, sits outside the token requirement's reach [8].
The probe count is a number about somebody else's telemetry. 69,433 across March 2025 averages about 2,240 a day [18], all of it attributed by F5 Labs to a single actor hitting one address [1]. No zero-day was involved, and every parameter name in the set ships in production APIs [2]. For that traffic to mean anything about your fleet, an endpoint has to accept a URL under one of those names or near it, the request has to egress to the link-local address, and the instance serving it has to still answer v1 [7][9]. The first two are code review questions. The third was answered at launch, because when AWS changed the default in November 2023 it changed it for new instances and left running ones alone [9]. The campaign sits roughly sixteen months downstream of that change [19].
The taxonomy in the write-up is looser than the headline count suggests. Six probe names appear, url, dest, file, redirect, target and uri [1], and six parameter categories are named [5], but they are not the same six: redirect and uri are mapped to no category, and renderers, avatar fetchers, link previewers and OAuth callback validators are listed with no parameter names attached [20]. Use it as a feature checklist, not a grep pattern. As a checklist it holds: an e-commerce API with payment webhooks, avatar uploads, link previews and one OAuth callback already covers four of the six categories before its first deploy [6], which is roughly why OWASP puts webhooks, callbacks and URL imports first in API7:2023 [4].
Two of the CVEs show that the parameter is often not yours to review. CVE-2021-21985 scored 9.8 because the vSAN Health Check plugin was enabled by default in vCenter 6.5, 6.7 and 7.0, exposed an unauthenticated API on 443, and took a URL parameter that reached RCE with the vCenter service account's privileges [16]. That parameter came from the plugin's default configuration, not from any operator. ProxyLogon, CVE-2021-26855, did it with a cookie: Exchange ECP accepted X-BEResource and routed requests to arbitrary internal backends without authentication, which chained with CVE-2021-26858 into OS-level RCE and was worked by Hafnium and multiple ransomware operations in Q1 2021, before patches reached most organisations [14]. The dev.to write-up argues that on cloud-hosted Exchange the same routing lands on 169.254.169.254 instead of an on-premise backend [15].
CVSS is the wrong ledger for this class. Adminer's 7.2 scores the fetch alone; the outcome that mattered was the role credentials it produced [10], and the write-up's own position is that cloud-hosted SSRF consistently outruns its score [17]. The figure that tracks the exposure is the count of running instances nobody has migrated off v1 [9].
