Fetch-url-file-3a-2f-2f-2froot-2f.aws-2fconfig [better] Jun 2026

Modern browsers restrict fetch() on file:// URIs due to cross-origin security policies. However, in server-side JavaScript (Node.js with node-fetch or axios ), there is no such restriction. An attacker who can control a server-side fetch call (e.g., through a parameter passed to an API endpoint) can read arbitrary files.

Server-Side Request Forgery occurs when an attacker misuses a functionality on a server to make internal or external HTTP/file requests on behalf of the application. Why the file:// Scheme is Dangerous

To understand the target of the request, we must first decode the URL-encoded string: fetch-url-file-3A-2F-2F-2Froot-2F.aws-2Fconfig

for EC2/Lambda so that credentials are temporary and rotated. Least Privilege:

This file is typically used to define profiles, regions, and output formats for the AWS CLI. Modern browsers restrict fetch() on file:// URIs due

fetch-url-file:///root/aws/config

In php.ini :

So file-3A-2F-2F-2Froot-2F.aws-2Fconfig becomes file:///root/.aws/config after replacing -3A with : , -2F with / , and noting that -2F appears three times consecutively: -2F-2F-2F → /// .