3 ms·
modsec
by akamai 7y ago
modsec
- october_sky 7y agoWhat's wrong with modsec?
- akamai 7y agoNothing. The problem here was not the waf, but the credential/role being compromised.
- ownagefool 7y agoApparently it was both. The WAF was used to SSRF the metadata service which would have exposed the role. Why a WAF role needed so much access to data is something that's hard to explain, and would suggest a major fuckup by the teams involved.
- ownagefool 7y agoDoubt it. Modsec wouldn't need access to all your data, would it? Something commercial that was bought by a ciso or security person who has no common sense, that asks to specifically be configured with access to that much data. That's my bet.