Cloud Hacking Competition Reports RCE Findings in Databases and Linux
Summary
At Wiz Research’s two-day cloud hacking competition, researchers reported successful vulnerability demonstrations involving Redis, PostgreSQL, MariaDB, Grafana and the Linux kernel, earning $320,000. Attempts involving vLLM and Ollama timed out.
Key points
- Researchers reported an 85% success rate across live hacking attempts and $320,000 in total rewards.
- Successful demonstrations included RCE vulnerabilities in Redis, PostgreSQL, MariaDB and Grafana, as well as a Linux kernel container escape.
- Wiz says the Linux finding could allow an attacker to escape a container and reach underlying infrastructure in a multi-tenant cloud environment.
- Attempts to exploit vLLM and Ollama did not succeed within the allotted time.
Article Details
- Event Type
- Cloud security hacking competition and vulnerability research event
- Impact
- Researchers demonstrated critical remote code execution vulnerabilities in Redis, PostgreSQL, MariaDB, Grafana, and the Linux kernel, including a Linux container escape that could reach underlying multi-tenant infrastructure. The article reports that attempted exploits involving vLLM and Ollama were unsuccessful within the allotted time. The event awarded $320,000 in total and reported an 85 percent success rate across live hacking attempts.
People
Bohdan IvanenkoResearcher whose vLLM exploit attempt exceeded the time limit.Daniel FirerResearcher who successfully demonstrated vulnerabilities in PostgreSQL and Redis at the competition.Emil LernerResearcher who successfully demonstrated a Redis vulnerability at the competition.FaithTeam CCC member from Zellic who participated in a successful Linux Kernel exploit demonstration.Moritz SanftMember of Team Bugz Bunnies, which successfully demonstrated an authenticated RCE in Grafana and attempted an Ollama exploit that exceeded the time limit.Paul GersteMember of Team Bugz Bunnies, which successfully demonstrated an authenticated RCE in Grafana and attempted an Ollama exploit that exceeded the time limit.PumpkinTeam CCC member from DEVCORE Research Team who participated in a successful Linux Kernel exploit demonstration.Yoni SherezResearcher who successfully demonstrated a Redis vulnerability at the competition.
Vendors
Amazon Web ServicesLast week in London, Wiz Research hosted a first-of-its-kind cloud hacking competition in partnership with AWS, Microsoft, and Google Cloud. Over two days, the world’s top researchers came together to test the securityGoogle CloudResearch hosted a first-of-its-kind cloud hacking competition in partnership with AWS, Microsoft, and Google Cloud. Over two days, the world’s top researchers came together to test the security of the open-sourceMicrosoftin London, Wiz Research hosted a first-of-its-kind cloud hacking competition in partnership with AWS, Microsoft, and Google Cloud. Over two days, the world’s top researchers came together to test the security of theWizLast week in London, Wiz Research hosted a first-of-its-kind cloud hacking competition in partnership with AWS, Microsoft, and Google Cloud. Over two days, the world’s top researchers came together to test the security
Products
GrafanaGrafana: Team Bugz Bunnies (Paul Gerste & Moritz Sanft) – SUCCESSFUL – $10,000 awarded (authenticated RCE)LinuxThe most severe exploit targeted the foundation of the cloud itself: the LinuxMariaDBResearchers demonstrated vulnerabilities in the world's most popular databases: Redis, PostgreSQL, and MariaDB - the very vaults where the cloud stores its most critical information.OllamaResearchers also attempted to demonstrate exploits for vLLM and Ollama, the de facto standards for running open-source AI models. One of the exploits would’ve let attackers gain direct access to major enterprises'PostgreSQLResearchers demonstrated vulnerabilities in the world's most popular databases: Redis, PostgreSQL, and MariaDB - the very vaults where the cloud stores its most critical information.RedisResearchers demonstrated vulnerabilities in the world's most popular databases: Redis, PostgreSQL, and MariaDB - the very vaults where the cloud stores its most critical information.vLLMResearchers also attempted to demonstrate exploits for vLLM and Ollama, the de facto standards for running open-source AI models. One of the exploits would’ve let attackers gain direct access to major enterprises'