medium

Lightsail object storage access keys logged

Published Thu, Aug 5th, 2021
Platforms

Summary

Lightsail object storage allows the creation of access keys which were logged to CloudTrail (both access key and secret key)

Affected Services

Lightsail

Remediation

Roll access keys

Tracked CVEs

No tracked CVEs

References

Contributed by https://github.com/0xdabbad00
Entry Status
Finalized
Disclosure Date
Thu, Aug 5th, 2021
Exploitablity Period
-
Known ITW Exploitation
-
Detection Methods
-
Piercing Index Rating
-
Discovered by
Scott Piper, Summit Route

More vulnerabilities...

medium

DHCP abuse for code exec

Under certain conditions, an attacker can flood DHCP packets to the victim VM, allowing it to impersonate the Metadata server, and grant themselves SSH access.

Imre Rad

low

Elastic Beanstalk - XSS in Web Console

An adversary could gain access to IAM credentials in a victim's account, and make an API request to Elastic Beanstalk (even if they didn't have the proper IAM permissions). This request would be di...

...
Nick Frichette

critical

OMIGOD

Azure forces the install of an agent on Linux VMs, which contained a vulnerability that would grant root RCE if an attacker could send a web request to them. Initially, Microsoft did not update the...

...
Nir Ohfeld, Wiz

View all