PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Beyond CVEs: The Exploitation of Everyday Misconfigurations

wiz.io | blog | #cloud-security | #postgresql | #misconfiguration | #initial-access | #selenium-grid | #spring-boot
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

From a DistrictCon talk, Wiz shows how everyday misconfigurations in Selenium Grid, Spring Boot and PostgreSQL became full compromise — no CVE needed, just default credentials and exposed services.
Published
Collected

Related coverage

blog · wiz.io
Soco404: Multiplatform Cryptomining Campaign Uses Fake Error Pages to Hide Payload
Wiz tracks Soco404, a cryptomining campaign abusing PostgreSQL misconfigurations: it hits Linux and Windows, masquerades as system processes, hiding payloads in fake 404 pages on Google Sites.
blog · wiz.io
CPU_HU: Fileless cryptominer targeting exposed PostgreSQL with over 1.5K victims
Wiz Threat Research details JINX-0126, which abuses weak PostgreSQL credentials to run fileless XMRig-C3 cryptominers while dodging hash-based detection; C3Pool data suggests over 1,500 victims.
blog · wiz.io
Under the Radar: Exploring Spring Boot Actuator Misconfigurations
Wiz Threat Research examines Spring Boot Actuator misconfigurations that leak credentials and API keys—and can enable RCE—found in one in four environments with exposed endpoints.
blog · wiz.io
Making Sense of Kubernetes Initial Access Vectors Part 2 - Data Plane
Part two of Wiz's Kubernetes initial access series covers data plane vectors: application RCE, service account privilege abuse, container image risks and escapes, and execution-as-a-service workloads.
blog · wiz.io
Making Sense of Kubernetes Initial Access Vectors Part 1 – Control Plane
First of a two-part series: Wiz introduces a taxonomy of Kubernetes initial access vectors spanning control plane, data plane, cloud, and CI/CD, then drills into control plane access and detection.
blog · wiz.io
Setting secure defaults on AWS and avoiding misconfigurations
Wiz's Scott Piper explains enforcing secure AWS defaults with SCPs—blocking public S3 buckets, disabling risky features and protecting the guardrails themselves—with rollout checks.
Back