News for hackers. Stuff that matters.

A comment on BreakingFormation: AWS CloudFormation Vulnerability.

Re:BreakingFormation: AWS CloudFormation Vulnerability by cateof on Thursday January 13, 2022 @02:59PM (#29925985)
Seems like the AWS Glue exploit [1] discovered by the same team is the more critical one of these two. The CTO of Orca confirmed that they were able to access an admin role in an AWS service account, and from there assume roles in customer accounts with service roles that trust the glue service [2].

1: https://orca.security/resources/blog/aws-glue-vulnerability/ 2: https://twitter.com/yoavalon/status/1481691075672694793

[ Parent | on HN ]
Re:BreakingFormation: AWS CloudFormation Vulnerability by orf on Thursday January 13, 2022 @09:08PM (#29929795)
What’s the actual exploit? Both of the articles are completely barren.
[ Parent | on HN ]