March 22–23, 2019: Paige Thompson executes the SSRF attack. She exploits a misconfigured WAF (ModSecurity running on an EC2 instance). The WAF is configured to forward certain requests to backend services — Thompson finds it will also make outbound requests to arbitrary URLs, including the metadata endpoint.
The specific vulnerability: The WAF had a misconfigured rule that allowed a specific HTTP header to cause the WAF to make a proxied request to an attacker-specified destination. The destination could be the metadata endpoint.
What she accessed: Over 100 S3 buckets containing Capital One customer data — 100 million US and Canadian customers’ credit card applications. Data included: names, addresses, zip codes, phone numbers, email addresses, dates of birth, reported income, credit scores, credit limits, payment history, contact history, SSNs (140,000), linked bank account numbers (80,000).
The SSRF was the entry point. The blast radius was determined by IAM role over-permissioning — the EC2 role had access to over 100 S3 buckets it didn’t need. Least-privilege IAM would have limited the damage even if the SSRF was exploited.