The HTTP 303 SSRF Hack : From Python HTTP Client Defaults to AWS Credential Exfiltration. A Deep Dive Into Escalating a Blind SSRF to Full Read

A detailed bug bounty writeup documenting how a blind SSRF was escalated to full AWS IAM credential exfiltration. The chain exploits four composing weaknesses: an unvalidated token_uri field in BigQuery service account JSON, Python requests library's default redirect-following behavior, IMDSv1 being reachable from the worker pod, and an error path that reflected raw exception content. The key insight is using HTTP 303 See Other to convert a POST (which IMDS rejects with 405) into a GET, allowing the attacker's redirect server to transparently proxy the OAuth request to the AWS Instance Metadata Service. The exploit yielded live AWS AccessKeyId, SecretAccessKey, and SessionToken for the EKS node's IAM role. Remediation was an allowlist restricting token_uri to known Google OAuth endpoints.