3 ms·
What's wrong with modsec?
by october_sky 7y ago
What's wrong with modsec?
- akamai 7y agoNothing. The problem here was not the waf, but the credential/role being compromised.
- ownagefool 7y agoApparently it was both. The WAF was used to SSRF the metadata service which would have exposed the role. Why a WAF role needed so much access to data is something that's hard to explain, and would suggest a major fuckup by the teams involved.