Capital One (2019): An SSRF Misconfiguration Breach in the Cloud
Summary
In July 2019, Capital One disclosed a data breach affecting over 100 million individuals in the U.S. and 6 million in Canada, involving credit card application data. A former Amazon Web Services employee was arrested and charged in connection with the intrusion.
Technical Root Cause
The attacker exploited a Server-Side Request Forgery (SSRF) vulnerability (CWE-918) in a misconfigured web application firewall (WAF) sitting in front of a Capital One application hosted on AWS. The SSRF flaw allowed the attacker to trick the WAF into making requests to the AWS Instance Metadata Service (IMDS), which returned temporary security credentials for an IAM role. Those credentials had permissions broader than the specific application required, allowing the attacker to list and read data from a large number of S3 storage buckets.
Why It Mattered
This breach became a widely cited example of cloud misconfiguration risk distinct from traditional on-premise vulnerabilities: the vulnerable component was a WAF configuration, the credential theft mechanism was cloud-metadata-specific, and the impact was amplified by overly broad IAM permissions attached to the compromised role (violating least-privilege principles).
OWASP / CWE Mapping
- CWE-918: Server-Side Request Forgery (SSRF)
- OWASP A10:2021: Server-Side Request Forgery
- OWASP A01:2021: Broken Access Control (excessive IAM permissions)
Lasting Impact
The incident drove wider adoption of IMDSv2 (a version of the AWS metadata service designed to be more resistant to SSRF-based credential theft) and reinforced the principle that cloud IAM roles should be scoped as narrowly as possible, since an SSRF or similar flaw in an application effectively inherits whatever permissions its role carries.
How Safeguard Helps
Safeguard's DAST scanning tests for SSRF vulnerabilities in web-facing applications and cloud-adjacent risk analysis can flag overly permissive IAM role configurations attached to internet-facing workloads.
