PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Avoiding security incidents due to request collapsing

wiz.io | blog | #cloud-security | #aws | #data-exposure | #misconfiguration | #web-caching | #cloudfront
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Scott Piper explains request collapsing, a web caching behavior that can return one user's response to another even with no-cache headers, and shares safeguards drawn from 14 tracked incidents.
Published
Collected

Related coverage

blog · wiz.io
A security community success story of mitigating a misconfiguration
The story of fixing a common misconfiguration: GitHub Actions OIDC trust policies missing their 'sub' condition let anyone assume AWS roles, until coordinated research pushed defaults to change.
blog · hackenproof.com
New Discovery: Nokia left its cloud environment open, config details exposed
HackenProof disclosed that Nokia left one of its cloud environments open to the internet, exposing configuration details.
blog · hunt.io
Over 68 GB of Philippine Overseas-Employment Database Backups Copied From an Exposed Staging Server
An exposed staging server at UpCloud revealed a completed 68 GB copy of 27 Philippine overseas-employment database backups, a rebranded GodPotato privilege escalation tool, and the operator's own transfer logs.
blog · netspi.com
Stay Ahead of Cloud Threats: Introducing Azure and AWS Security Reviews
Discover how NetSPI's Azure & AWS Configuration Reviews provide continuous visibility, risk identification, and actionable insights to secure your cloud environments.
blog · netspi.com
Overcome Cloud Security Challenges with Purpose-Built Cloud Penetration Testing
Outlines five cloud security challenges—shadow IT, attacker-defender resource asymmetry, catastrophic misconfigurations—and argues purpose-built cloud penetration testing is the way to address them.
blog · netspi.com
Your Cloud Assets are Probably Not as Secure as You Think They Are
Gartner attributes up to 95% of cloud breaches to human configuration errors; NetSPI catalogs usual suspects like missing MFA, cloud-on-prem integration, and over-permissioned accounts.
Back