---
id: 2609
title: "How a startup’s cloud got taken over by a simple form that sends emails"
source_domain: aikido.dev
source_url: "https://www.aikido.dev/blog/how-a-startups-cloud-got-taken-over-by-a-simple-form-that-sends-an-email"
published_at: "2023-04-10T00:00:00Z"
tags: ["cloud", "cloud-security", "aws", "php", "ssrf", "iam", "incident-analysis", "imds", "iam-credentials"]
phying_url: "https://phying.com/item/2609"
lang: en
---

# How a startup’s cloud got taken over by a simple form that sends emails

## Summary

An SSRF bug in a PHP email form let attackers fetch EC2 IMDSv1 credentials and pivot to S3 buckets and CloudFormation templates with API keys; the walkthrough covers the chain and IMDSv2 mitigation.

## Intelligence Metadata

- **Sources:** aikido.dev
- **Published:** 2023-04-10T00:00:00Z
- **Original:** https://www.aikido.dev/blog/how-a-startups-cloud-got-taken-over-by-a-simple-form-that-sends-an-email
- **Phying News:** https://phying.com/item/2609