low

Timing attack with Lambda and CloudWatch Synthetics

Published Tue, Sep 15th, 2020
Platforms

Summary

The immutability of Lambda versions could be violated via a timing attack against CloudWatch Synthetics canaries.

Affected Services

Lambda, CloudWatch Synthetics

Remediation

None required

Tracked CVEs

No tracked CVEs

References

Contributed by https://github.com/ramimac
Entry Status
Finalized
Disclosure Date
Tue, Sep 15th, 2020
Exploitablity Period
-
Known ITW Exploitation
-
Detection Methods
-
Piercing Index Rating
-
Discovered by
Ian Mckay

More vulnerabilities...

low

CloudFormation denial of service (in a single account)

An attacker with the ability to create CloudFormation stacks could cause a denial-of-service on some CloudFormation actions within a single AWS account.

...
Ian Mckay

medium

GCP service accounts and projects information leak

It was possible to list IAM service accounts of any GCP project, given only its ID, by forging a pageToken for the projects.serviceAccounts.list method of the IAM API. Due to the design of certain...

...
Ezequiel Pereira

critical

Dropping a Shell in Google Cloud SQL

Researchers discovered vulnerabilities in Google Cloud SQL that allowed gaining unauthorized shell access to MySQL instances. By chaining SQL injection, parameter injection in mysqldump, and networ...

Ezequiel Pereira and Wouter...

View all