AWS RDS Vulnerability Leads to AWS Internal Service Credentials

Re:AWS RDS Vulnerability Leads to AWS Internal Service Crede... by thinkmassive on Tuesday April 12, 2022 @01:56AM (#30999102)

Seems like an unusually simple exploit, essentially using an advanced postgres feature as intended. Impressive though!

The fact AWS overlooked access controls allowing a customer to reach system files, let alone the STS token, on a multi-tenant service is worrisome.

[ Parent | on HN ]

Re:AWS RDS Vulnerability Leads to AWS Internal Service Crede... by Beltiras on Tuesday April 12, 2022 @05:49AM (#31000525)

I think it just speaks to the complexity we are reaching in software engineering. Feature A and feature B might be safe in and of themselves but a composition contains a vulnerability.

[ Parent | on HN ]

Re:AWS RDS Vulnerability Leads to AWS Internal Service Crede... by omegalulw on Tuesday April 12, 2022 @05:59PM (#31008756)

That's not a new problem, it's an age old problem with any complex system; they will always be emergent effects.

[ Parent | on HN ]