---
name: rt-scenario-c003
description: "C-003: Cloud metadata exposure risk assessment through SSRF or workload misconfiguration. Domain: cloud. Authorized scenario for IMDS protection, workload identity minimization, and SSRF remediation."
---

# C-003: Metadata Exposure Risk

## Overview

Applications running on cloud compute may have access to metadata services and workload credentials. If an SSRF or egress flaw reaches metadata endpoints, a web vulnerability can become cloud identity compromise.

| Field | Value |
|---|---|
| Domain | Cloud / Web |
| Objective | Assess metadata credential exposure risk |
| Required Access | In-scope app and cloud workload context |
| Detection Risk | Medium for active validation |
| Primary Impact | Workload credential exposure |

## Prerequisites

- Application endpoint in scope.
- Cloud workload identified.
- SSRF testing approved.
- Metadata access rules defined.
- No harvesting live credentials unless explicitly authorized.

## Workflow

1. Map URL-fetching or webhook features in the application.
2. Identify cloud workload and assigned role/identity.
3. Review metadata service hardening: IMDSv2 or provider equivalent.
4. Validate SSRF using benign callback or safe metadata endpoint.
5. Determine role blast radius from IAM policy review.
6. Recommend SSRF and cloud identity hardening.

## Safe Evidence

Prefer:

- Metadata service configuration.
- Egress path proof to controlled callback.
- IAM role policy summary.
- Blocked metadata request screenshot.

Avoid collecting live temporary credentials unless approved.

## MITRE ATT&CK Mapping

| Phase | Tactic | Technique |
|---|---|---|
| Initial Access | Initial Access | Exploit Public-Facing Application |
| Credential Access | Credential Access | Cloud Instance Metadata API |
| Valid Access | Defense Evasion / Persistence | Cloud Accounts |

## Detection

- Web requests to metadata IPs.
- Unusual egress from application servers.
- Temporary credential use from unexpected IPs.
- IAM API enumeration after web-layer anomaly.

## Remediation

- Enforce IMDSv2 or equivalent.
- Block metadata IP access from application fetchers.
- Add URL allowlists and DNS/IP validation.
- Remove unnecessary workload permissions.
- Add egress filtering.
- Monitor cloud credential use.

