Is your environment affected by this misconfiguration?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsFrameworks
CIS-ControlsCSA-CCM
- Snyk IDSNYK-CC-TF-130
- creditSnyk Research Team
Description
Metadata service may be vulnerable to reverse proxy/open firewall misconfigurations and server side request forgery attacks
How to fix?
Set metadata_options.http_tokens attribute to required
Set MetadataOptions.HttpTokens attribute to required in AWS::EC2::LaunchTemplate
References
- https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html
- https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html
- https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instancedata-data-retrieval.html
- https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service/