Skip to content
experience

closed as informative: the SSRF that read the cloud metadata and still was not "a bug"

Nadia Benali@nullbyte_nadia

August 30, 2026 · 2 min read

#1 in Hack The Planet

a short angry story, because I need to vent and because "informative" is the most insulting word in bug bounty.

a company (private program, calling them "Shipr") had an image import feature. you give it a url, it fetches the image server side and stores it. classic SSRF territory. I pointed it at an internal address that only their own servers can reach, the kind of link to a cloud metadata service, and it happily fetched it and showed me the response. on a lot of cloud setups that response is temporary credentials for the server's role. I did not pull credentials. I proved the server would fetch an internal only address and return the body, screenshotted it, redacted it, stopped there, and wrote "this is SSRF reaching the metadata endpoint, please confirm IMDSv2 is enforced, I have not pulled any tokens".

they closed it as informative. reason: "the url was provided by the user, this is expected behaviour". expected behaviour. the server fetching its own internal network on command is expected behaviour. voilà.

I appealed once with a calm explanation of what SSRF to metadata usually leads to, linked their own cloud provider's docs saying to enforce IMDSv2 exactly to stop this, and left it. three weeks later the import feature quietly started rejecting internal addresses. no reopen, no bounty, no thanks. they fixed it and kept pretending it was never broken.

the lesson for anyone starting: "informative" sometimes means "you are wrong" and sometimes means "you are right and we do not want to pay you". learn to tell the difference, keep your reports factual, never pull the credential just to prove the point (you do not need to, and now you are the one with a problem), and move on. the fix shipping IS the win, even when the platform never admits it. the bounty would have been nicer though. I am not a saint.

#security#bug-bounty#cloud

Get the best of #hack_the_planet weekly

One email each Monday with the most useful posts. No spam; unsubscribe in one click.

Comments

8

Sign in to join the conversation.

Sign in to comment
Kabir Sethi@0xkabir#5 in Hack The Planet
INFORMATIVE. the word that costs me sleep. i had a ssrf marked informative once and watched them patch it 2 weeks later from the same account. "expected behaviour" is triager for "we are broke this quarter"
6 net votes
Fatima Al-Sayed@fatima_appsec#8 in Hack The Planet
The restraint is the professional part. Reaching metadata is enough to demonstrate impact, you never need to actually exfiltrate the role credentials, and the moment you do you have gone from researcher to the thing their incident response is now chasing. IMDSv2 should be the default everywhere by now and it still is not.
2 net votes
Nadia Benali@nullbyte_nadia#1 in Hack The Planet
exactly @fatima_appsec, the credential is the line. prove the fetch, stop, write it up. anyone telling a beginner to "grab the creds to show real impact" is telling them to commit a crime for a screenshot.
3 net votes
Nate Calloway@nostep_nate1 rep in Hack The Planet
or, hear me out, companies should be allowed to decide what is a bug on their own product without being blackmailed by a public clock
-11 net votes
Nadia Benali@nullbyte_nadia#1 in Hack The Planet
nobody blackmailed anyone. I reported it privately, they ignored it, they fixed it silently. the only "clock" was me saying I would write about it after it was patched, which it is. you can log off now.
3 net votes
Marcus Johnson@marcus_oncall1 rep in Hack The Planet
we had an SSRF turn into a metadata leak at a place i worked years ago and it was a BAD week, so reading a researcher say "i stopped at proving the fetch" is genuinely refreshing because the one who found ours did not stop and that made the cleanup ten times worse
4 net votes
Arash Karimi@arash_403#7 in Hack The Planet
The quiet fix with no credit is its own kind of insult. You made their product safer for free and they could not even write "thank you". I have had my sanctioned country reports closed as "not applicable in your region", which is its own genre of informative.
2 net votes
Hodan Abdi@hodan_soc#8 in Hack The Planet
from the blue side: thank you for not pulling the token, you have no idea how much of my 3am life is "a researcher got curious and now the SOC thinks the box is popped" 🫠 a clean SSRF report with no actual access is a gift
-1 net votes