IMDSv1 on AWS EC2 Poses SSRF Risk; Migrating to IMDSv2 Requires Careful Planning

·1 views

Amazon EC2's Instance Metadata Service (IMDS) allows software running inside an instance to query instance details, including temporary IAM credentials via the link-local address 169.254.169.254. IMDSv1 accepts direct HTTP requests with no authentication, making it vulnerable to Server-Side Request Forgery (SSRF) attacks — a weakness that played a role in the 2019 Capital One breach, which exposed data of over 100 million people. IMDSv2 addresses this by requiring a session token obtained through a PUT request before any metadata can be accessed. While switching to IMDSv2 is straightforward in the EC2 console, AWS warns administrators to first confirm no existing applications, agents, SDKs, or scripts still rely on IMDSv1 calls. The CloudWatch metric MetadataNoToken can help identify such dependencies before enforcing the stricter version.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

OpenPledge Uses Blockchain and AI to Make Charity Donations Fully Transparent

A developer has built OpenPledge, an open-source donation platform designed to give donors complete visibility into where their money goes. Every contribution is recorded on the Solana blockchain, creating a permanent, publicly verifiable transaction record that cannot be altered. Google Gemini generates a personalised thank-you message for each donor, which ElevenLabs then converts into spoken audio, while Snowflake powers a public Impact Dashboard showing aggregate giving trends. The platform requires no login and features a public ledger linking every donation directly to its on-chain record. OpenPledge was submitted as part of a weekend developer challenge and is currently live at open-pledge.vercel.app, with full source code available on GitHub.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

WebForms Core 2.1 Introduces WPC Criteria as an Advanced Alternative to CSS Selectors

WebForms Core 2.1 has expanded its built-in domain-specific language, WebForms Place Criteria (WPC), which allows developers to select, filter, and manipulate HTML and DOM elements. Unlike standard CSS selectors, WPC Criteria enables filtering of already-selected elements based on text content, attributes, visibility, state, position, and DOM relationships. Developers can chain multiple conditions and apply operators to build complex selections that go beyond simple ID, class, or tag-based queries. WPC also supports text searches and attribute-value matching, such as finding elements whose attribute values end with a specific string. The feature is exclusive to the WebForms Core framework and is not available as a standalone or external tool.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Wraps Pay-Per-Call APIs in MCP Server, Joins Official Registry for Free

A developer who had failed to earn revenue from REST-based pay-per-call APIs repackaged them as tools inside a single MCP server using the streamable-HTTP transport. The server uses the x402 protocol to charge USDC micropayments only when an agent actually invokes a tool, while keeping discovery methods like tools/list and initialize free. Three tools are offered — a QR code generator, an image processor, and an LLM-backed text analyser — priced between $0.01 and $0.02 per call. The server was listed on the official MCP Registry without a GitHub account by using HTTP-based Ed25519 key authentication tied to a free sslip.io hostname on a $4 VPS. The developer concludes that packaging APIs as MCP tools, rather than REST endpoints, is critical for reaching AI agents as customers.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Ruby gem 'fundamentalista' pulls free SEC EDGAR data for stock fundamental analysis

A new Ruby gem called 'fundamentalista' enables developers to perform fundamental analysis on publicly listed companies using data sourced directly from SEC EDGAR's free XBRL filings. Version 0.6.0 is now available on RubyGems and supports both US GAAP and IFRS filers in their respective reporting currencies. The gem provides income, balance sheet, and cash flow data alongside valuation metrics such as P/E ratios, discounted cash flow, Altman Z-score, and Piotroski F-score, all accessible through a clean, object-oriented API. It also integrates with Financial Modeling Prep for quotes, estimates, and exchange rates when an API key is provided. A companion Rails engine, 'fundamentalista-rails', adds watchlist functionality with ratio and valuation snapshots per holding.

0 comments Read more at DEV Community