Webhook-url-http-3a-2f-2f169.254.169.254-2fmetadata-2fidentity-2foauth2-2ftoken !!exclusive!!

: An attacker submits the Azure IMDS URL as the webhook destination. If the application does not validate the URL or restrict it to public domains, the server attempts to "notify" the webhook by calling the metadata service. Credential Theft : The request to /metadata/identity/oauth2/token

Here is how to lock it down:

At first glance, it looks like gibberish or a corrupted URL. But to a security engineer, this string is a . : An attacker submits the Azure IMDS URL

Executive Summary * In total we found four Azure services vulnerable to SSRF: Azure API Management, Azure Functions, Azure Machine... Orca Security But to a security engineer, this string is a

: The attacker can use this token from their own laptop to log into the victim's Azure environment with the same permissions as the compromised VM. How to Protect Your Environment How to Protect Your Environment : The VM

: The VM then uses this token to authenticate with other services, typically by including it in an Authorization header of subsequent HTTP requests.