Webhook-url-http-3a-2f-2f169.254.169.254-2fmetadata-2fidentity-2foauth2-2ftoken ((install))

First, let’s decode the URL encoding (percent-encoding) in the string:

: Only permit webhooks to specific, verified domains.

Attackers insert such URLs into places where an application makes an outbound HTTP request based on user input—for instance, a webhook URL field, a profile picture URL, a file import feature, or an XML external entity (XXE) payload.

: Webhook functionality is a prime target for SSRF because it inherently expects a URL and triggers the server to make an outbound request. Attack Step First, let’s decode the URL encoding (percent-encoding) in

This URL is not an ordinary web endpoint. It represents a targeted attempt by an attacker to exploit an application's webhook system to compromise internal cloud infrastructure. Deconstructing the Payload

Webhooks are user-defined HTTP callbacks triggered by specific events. For example:

The /metadata/identity/oauth2/token path specifically handles identity: What is this IP address: 169.254.169.254? - Server Fault Attack Step This URL is not an ordinary web endpoint

Azure requires the Metadata:true header. If a webhook or application is vulnerable to SSRF, an attacker might be able to trick the service into calling this endpoint and stealing the token.

This feature simplifies secure access to cloud resources and is a best practice for managing credentials within cloud environments.

(169\.254\.169\.254).*(metadata|identity|oauth2|token) HTTP/1.1 200 OK Content-Type: application/json

def is_safe_webhook_url(user_input): decoded = unquote(user_input) parsed = urlparse(decoded) if parsed.scheme not in ('http', 'https'): return False # Resolve hostname to IP import socket try: ip = socket.gethostbyname(parsed.hostname) except: return False # Reject private, link-local, loopback private = ipaddress.ip_network('10.0.0.0/8') link_local = ipaddress.ip_network('169.254.0.0/16') loopback = ipaddress.ip_network('127.0.0.0/8') ip_obj = ipaddress.ip_address(ip) if ip_obj in private or ip_obj in link_local or ip_obj in loopback: return False # Additional: allowlist check allowed = ['api.yourservice.com'] if parsed.hostname not in allowed: return False return True

In summary, the webhook URL http://169.254.169.254/metadata/identity/oauth2/token is a critical component of Azure's Instance Metadata Service. It allows Azure VMs to obtain OAuth2 tokens for authentication purposes, making it easier to integrate with other services and applications.

HTTP/1.1 200 OK Content-Type: application/json