/proxy/ URL scans with IP addresses, (Mon, Mar 16th)
Source SANS ISC Handlers Diary
Description
Attempts to find proxy servers are among the most common scans our honeypots detect. Most of the time, the attacker attempts to use a host header or include the hostname in the URL to trigger the proxy server forwarding the request. In some cases, common URL prefixes like "/proxy/" are used. This weekend, I noticed a slightly different pattern in our logs:
Impact
If successful, this threat can lead to unauthorized access to cloud instance metadata services, exposing IAM security credentials and instance identity documents. This can result in attackers gaining elevated privileges within cloud environments, enabling lateral movement, data exfiltration, resource manipulation, or deployment of further malicious activities. Organizations relying on proxies, API gateways, or load balancers that forward requests without proper validation risk becoming unwitting proxies for SSRF attacks. The compromise of cloud credentials can have severe consequences including financial loss, reputational damage, and regulatory penalties. The threat affects cloud infrastructure security posture and can undermine trust in cloud deployments. Even though no known exploits are currently active, the reconnaissance activity indicates an ongoing interest in exploiting such misconfigurations, making timely mitigation critical. The impact is especially significant for organizations with extensive cloud presence and complex proxy architectures.
Defensive guidance
1. Audit and harden proxy server configurations to ensure they do not forward arbitrary requests to internal services such as the cloud metadata endpoint (169.254.169.254). 2. Implement strict allowlists on proxies, API gateways, and load balancers to block requests containing suspicious URL patterns like /proxy/ or attempts to access link-local IP addresses. 3. Enforce network segmentation and firewall rules that prevent external or untrusted sources from reaching the metadata service. 4. Upgrade to and enforce the use of cloud provider metadata service version 2 (IMDSv2) which requires session tokens and custom headers, mitigating SSRF risks. 5. Monitor logs for unusual requests containing IPv4-mapped IPv6 addresses, long integer IP formats, or access attempts to /proxy/ paths. 6. Conduct regular penetration testing and proxy validation using the observed URL patterns to identify and remediate proxy forwarding vulnerabilities. 7. Educate development and operations teams about SSRF risks and secure proxy usage. 8. Employ Web Application Firewalls (WAFs) with custom rules to detect and block SSRF and proxy abuse attempts. 9. Disable or restrict proxy features that allow forwarding of arbitrary host headers or URLs. 10. Use cloud-native security tools to monitor and alert on suspicious metadata service access patterns.
Summary
This threat involves attackers scanning for proxy servers by sending HTTP requests with URL paths prefixed by /proxy/ followed by various IP address formats, specifically targeting the cloud instance metadata service typically hosted at the non-routable IP 169.254.169.254. The metadata service provides sensitive information such as IAM security credentials and instance identity documents, which if accessed by unauthorized parties, can lead to privilege escalation and cloud resource compromise. The attackers attempt to bypass common filters by encoding the target IP in multiple ways: standard IPv4, IPv4-mapped IPv6 (::ffff:), zero-padded IPv6 notation, and the long unsigned integer representation of the IP address. These techniques aim to evade simplistic pattern matching or IP-based filtering. The attack leverages the assumption that the proxy server will forward the request to the metadata service, effectively acting as an open proxy. While modern cloud providers have introduced version 2 of the metadata service requiring session tokens and custom headers to mitigate SSRF attacks, this scanning assumes a proxy that forwards requests without such protections. The threat highlights the risk posed by misconfigured proxies, API gateways, load balancers, or web application firewalls that may inadvertently expose internal services. The reconnaissance activity is detected by honeypots and shows attackers probing for weaknesses to exploit SSRF or proxy forwarding vulnerabilities to extract sensitive cloud credentials. No active exploits are reported yet, but the scanning pattern is a precursor to potential targeted attacks. The information serves as a warning to test proxy implementations against such URL patterns and to enforce strict access controls on metadata endpoints.