4 ms·
Seems like an unusually simple exploit, essentially using an advanced postgres feature as intended. Impressive though! The fact AWS overlooked access controls
by thinkmassive 5y ago
Seems like an unusually simple exploit, essentially using an advanced postgres feature as intended. Impressive though!
The fact AWS overlooked access controls allowing a customer to reach system files, let alone the STS token, on a multi-tenant service is worrisome.
- Beltiras 5y agoI think it just speaks to the complexity we are reaching in software engineering. Feature A and feature B might be safe in and of themselves but a composition contains a vulnerability.
- omegalulw 5y agoThat's not a new problem, it's an age old problem with any complex system; they will always be emergent effects.