Fetch-url-file-3a-2f-2f-2froot-2f.aws-2fconfig !new! -

[profile production] region = us-west-2 output = json role_arn = arn:aws:iam::123456789012:role/ProductionAccessRole source_profile = default

: Strictly allow only http and https protocols. Reject any request starting with file:// , gopher:// , or ftp:// . fetch-url-file-3A-2F-2F-2Froot-2F.aws-2Fconfig

# Vulnerable Python code import requests url = request.GET['url'] response = requests.get(url) # url = file:///root/.aws/config [profile production] region = us-west-2 output = json

Decoding the special characters, we get: fetch-url-file-3A-2F-2F-2Froot-2F.aws-2Fconfig