A WAF role with account-wide S3 access turned one SSRF into 106 million records

Every EC2 instance can reach 169.254.169.254, and nothing on the internet can route to it. It is link-local, so it exists only from the instance's own point of view, and what it returns includes temporary credentials for whatever IAM role is attached ^[12]. In 2019 that service, since named IMDSv1, answered any plain HTTP GET that originated on the instance, with no token and no authentication ^[13]. So the requirement for credentials collapsed to one thing: the ability to make the instance issue a request. A misconfigured web application firewall supplied that ^[3].

An IAM role is a set of permissions, and anything running on the instance can use them with no password and no key on disk ^[21]. The FBI complaint describes three commands. The first obtained security credentials. The second listed the names of folders and buckets. The third copied data out ^[14]. Trust Boundary's argument is that the third was a copy: authenticated, permitted, and at the API level indistinguishable from legitimate traffic ^[16].

A web application firewall inspects traffic, matches patterns, and blocks or forwards requests ^[11]. Trust Boundary allows a plausible reason for it to reach S3 for rule sets, configuration and logging, and none for it to enumerate storage across the account and read the contents ^[20]. The role on that instance could do both ^[4]. Credit card applications going back to 2005 were in the buckets it could read ^[10]. In my view that grant, not the firewall rule, is the first line item in a review.

Capital One's own statement says the company encrypts as standard ^[18], and the credentials that could read the objects could also decrypt them ^[26]. The statement puts it this way: "Due to the particular circumstances of this incident, the unauthorized access also enabled the decrypting of data." ^[17]

Eighteen months after the breach ^[19], the Office of the Comptroller of the Currency imposed an $80 million civil money penalty ^[5]. According to Trust Boundary, the consent order does not mention server-side request forgery at all ^[7]. The piece names OCC Consent Order 2020-036 among its primary sources but does not quote the order's findings ^[8][25]. Add the $190 million class action settlement ^[6] and the disclosed money reaches $270 million ^[22], about $2.55 for each of the 106 million people whose data was taken ^[23].

One detail to keep straight if you cite this incident in a design doc: the role appears in the indictment only as *****-WAF-Role, with the rest redacted, so a full role name in anyone's write-up is a guess ^[15].