3 ms·
There's an update blog post on this from Cloudflare's product security manager: https://ejj.io/blog/fixing-capital-one https://ejj.io/blog/fixing-capital-one
by photochemsyn 4y ago
There's an update blog post on this from Cloudflare's product security manager:
https://ejj.io/blog/fixing-capital-one https://ejj.io/blog/fixing-capital-one
The linked Wyden letter makes for interesting reading too:
> "While it is likely that Amazon has known that its AWS product was vulnerable to SSRF attacks since the first high-profile demonstration by a security researcher in 2014, the company has certainly known since mid-2018 at the latest. In August of 2018, Amazon's security team was contacted by email by a cybersecurity expert, who recommended that Amazon adopt the same cybersecurity defense against SSRF already used by Google and Microsoft. A copy of that email is attached. Amazon failed to act on this third-party report and has not provided an explanation for its inaction."
- Omnipresent 4y ago> The problem is common and well-known, but hard to prevent and does not have any mitigations built in to the AWS platform. Does anyone know if this is fixed by AWS now?
- thedougd 4y agoIMDSv2 with tokens required is the fix: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configur...
- zsims 4y agoPartial mitigation. It's not SSRF "proof" but I suppose nothing really is.
- deleted 4y ago[deleted]
- thereddaikon 4y agoWe aren't going to see real change until vendors start facing consequences for their negligence. Yes the criminals who exploit these vulnerabilities should go to prison but there also needs to be consequences for companies that don't bother patching vulnerabilities when they know better.