Not each safety vulnerability is excessive danger by itself – however within the palms of a complicated attacker, even small weaknesses can escalate into main breaches. These 5 actual vulnerabilities, uncovered by Intruder’s bug-hunting workforce, reveal how attackers flip missed flaws into critical safety incidents.
1. Stealing AWS Credentials with a Redirect
Server-Facet Request Forgery (SSRF) is a typical vulnerability that may have a big influence, particularly in cloud-hosted functions. If an online software fetches assets from user-supplied URLs, care ought to be taken to make sure attackers cannot manipulate requests to entry unintended assets.
Whereas assessing a home-moving app working in AWS, our workforce examined frequent SSRF bypass strategies.
The assault chain was as follows: the app despatched a webhook request to the attacker’s internet server, which responded with a 302 redirect to AWS’s metadata service. The app adopted the redirect and logged the response, which uncovered delicate metadata – together with AWS credentials.
With these credentials, an attacker may enumerate IAM permissions and try to pivot deeper into the cloud surroundings.
This assault wouldn’t have been attainable if the metadata service was implementing IMDSv2 – a finest observe {that a} good cloud safety scanner would have flagged. Whereas automated instruments may not have detected the total assault chain, breaking simply this a part of the chain may have prevented exploitation.
2. From Uncovered .git Repo to Full Database Entry
Whereas investigating an unintentionally uncovered .git repository flagged by a vulnerability scan, our workforce found it belonged to a publicly accessible internet software.
Reviewing the applying’s supply code, we uncovered an authentication bypass – the login web page could possibly be accessed by supplying a hidden parameter.
Our workforce gained entry to a administration software, the place additional evaluation revealed a blind SQL injection vulnerability in an authenticated web page.
Exploiting this vulnerability granted entry to a college’s database, which, if leveraged by an attacker, may have uncovered delicate private data of scholars and employees – displaying how a small misconfiguration can rapidly escalate into a serious safety danger.
3. How a Tiny Element Led to Distant Code Execution
Whereas looking for bugs in a doc signing app, our workforce observed that, after signing a PDF, the metadata listed “ExifTool” because the doc creator. Given ExifTool’s historical past of important vulnerabilities, we dug deeper.
Though the applying did not disclose the software’s model, testing for latest recognized vulnerabilities confirmed it was susceptible to CVE-2021-22204. By creating and importing a malicious PDF, our workforce efficiently gained distant command execution because the www-data person.
This foothold may have allowed an attacker to leverage further vulnerabilities on the affected server, enabling them to achieve root entry and pivot to different machines on the community, inflicting in depth injury.
4. From Self-XSS to Web site-Vast Account Takeover
Cross-site scripting (XSS) is a strong assault vector for session hijacking assaults, particularly when no person interplay is required. Whereas a ‘Self-XSS’ vulnerability is often low danger, it may well turn out to be harmful when mixed with one other vulnerability.
Our workforce uncovered this actual state of affairs whereas assessing an public sale software. A Self-XSS vulnerability was found the place a user-supplied HTTP request header was mirrored within the software’s response.
Usually, this may be innocent since an attacker cannot power a sufferer’s browser to ship a malicious header – however additional testing uncovered a cache-poisoning vulnerability.
By chaining these two weaknesses, our workforce tricked the app into caching and serving the Self-XSS payload to all website guests, escalating it to a site-wide persistent XSS assault.
This is able to have allowed an attacker to hijack any person account – together with admin accounts.
5. Altering a Quantity to Expose Delicate Information
API weaknesses are extra frequent than you’d suppose. Amongst them, IDOR vulnerabilities require little effort to take advantage of past modifying an identifier in a request.
The true problem for an attacker is not execution however discovery – discovering a susceptible endpoint that can be utilized with out correct authentication or authorization, and recognizing that it exposes delicate information. As soon as discovered, exploitation may be so simple as altering the identifier to a useful resource that the person doesn’t personal, or simply making a request to an endpoint that ought to be reserved for directors.
Our workforce incessantly identifies IDOR, lacking authentication, and damaged authorization weaknesses in APIs. Listed below are some snippets from actual HTTP requests and paths we discovered that uncovered extremely delicate information:
- GET /organisations/edit_user?user_id=1001: The attacker may modify person profiles and hijack accounts
- GET /prod-applicantresumes/12031.pdf: The attacker may entry job seekers’ CVs.
- POST /Order/Obtain, OrderNo=10202: The attacker may entry buyer order data.
These examples are about so simple as API weaknesses get, however the penalties are far-reaching. By merely altering one quantity and enumerating by means of 1000’s of values, complete databases of knowledge belonging to different prospects may be downloaded.
Cease breaches earlier than they begin
These real-world examples present how vulnerabilities can escalate into critical breaches when left unchecked. Attackers do not wait – they’re at all times trying to find new entry factors. Step one to staying forward? Figuring out what attackers can entry from the web – together with property you may not even know exist. Intruder constantly discovers these unknowns, like subdomains, logins, and APIs, and scans them for exposures that different options miss.
 |
| Intruder’s Discovery tab – for these property you probably did (or possibly did not know) existed |
From functions to cloud infrastructure, discover and safe it multi functional, highly effective platform with Intruder. Be taught extra or begin scanning with a 14 day free trial.
