Serverless security: the surface that remains
No servers to patch does not mean no risk: event injection, over-broad roles, vulnerable dependencies and secrets in variables.
notes on hacking and technology
|
main menu
user menu
topics
|
latest postsIaC and secrets: Terraform state in the clearTerraform's state file often holds secrets in cleartext. Committing it or dropping it in an open bucket is a breach. Kubernetes secrets: base64 is not encryptionKubernetes Secrets are merely base64-encoded and, by default, stored in cleartext in etcd. Whoever reads etcd reads everything. Managed identity: abusing the instance credentialsVMs and cloud services get tokens automatically from the identity endpoint. An RCE or SSRF on that resource inherits its roles. IMDSv1 vs IMDSv2: why the metadata endpoint changedIMDSv1 answered any request, so an SSRF stole credentials. IMDSv2 requires a token, closing the trivial abuse. HTTP request smuggling: disagreement on where a request endsFront-end and back-end read Content-Length and Transfer-Encoding differently. In the gap you smuggle a hidden request. Web cache poisoning: poisoning what everyone is servedAn input not in the cache key but reflected in the response lets you store a malicious version served to other users. Subdomain takeover: the CNAME pointing to nothingA subdomain pointing to a decommissioned service can be claimed by an attacker, who then serves content on your domain. GraphQL abuse: introspection, batching, depthGraphQL's flexibility is also its surface: exposed schema, nested queries for DoS, and authorization often missing per field. File upload: from profile picture to webshellAn upload that fails to validate type, extension and location can receive an executable script and serve it: remote code execution. Prototype pollution: poisoning Object.prototypeIn JavaScript, writing to __proto__ from untrusted input adds properties to every object, altering logic up to RCE. CORS misconfiguration: trusting the wrong OriginReflecting the Origin header with credentials enabled lets any site read the victim's authenticated responses. |
latest posts
your IP address:
216.73.216.108
visitor #0
MOTD:
Every abstraction leaks somewhere. Here we look at where. |
topics