API7:2023 — Server Side Request Forgery

Slide 1 · The Breach That Defined SSRF

100 million customer records. One URL. One metadata endpoint.

Capital One, July 2019 — the most consequential SSRF attack in history.

📄 Multiple sources · U.S. DOJ · OCC · 2019–2021

THE INCIDENT

Capital One Data Breach — July 2019

Capital One operated a web application firewall (WAF) on AWS to protect their cloud infrastructure. The WAF was misconfigured in a way that allowed it to make outbound HTTP requests to arbitrary URLs on behalf of an attacker — a textbook SSRF vulnerability.

Paige Thompson, a former AWS software engineer, discovered the misconfiguration. She sent a request to the WAF that caused it to fetch a specific URL: http://169.254.169.254/latest/meta-data/iam/security-credentials/

That URL is the AWS EC2 instance metadata endpoint — a service that returns temporary IAM credentials to any process running on the instance. The WAF fetched it, and returned the credentials to Thompson.

What happened next: Using the stolen IAM credentials, Thompson listed and downloaded over 100 S3 buckets containing Capital One customer data. The breach exposed personal information for 100 million US customers and 6 million Canadian customers, including Social Security numbers, credit scores, credit limits, transaction data, and linked bank account numbers. Thompson was arrested in July 2019 after posting about the breach on GitHub and Slack.

The cost

Capital One paid an $80 million fine to the Office of the Comptroller of the Currency (OCC), the largest fine ever levied for a cloud data breach at the time. A $190 million class-action settlement followed. Thompson was convicted of computer fraud and abuse in 2022.

← All modules What is SSRF? →