How Common Cloud Misconfigurations Can Lead to Code Execution and Data Exposure
Summary
Wiz explains how exposed services, weak credentials and excessive permissions can enable code execution or data theft, with examples involving Selenium Grid, Spring Boot Actuator and PostgreSQL, and recommends inventory, perimeter scanning and CI/CD checks.
Key points
- Wiz says common cloud misconfigurations include publicly exposed services, weak or default credentials, excessive permissions and exposed databases.
- Wiz reports that exposed Selenium Grid instances can be instructed to run commands; it says it tracked a threat actor using this method to run crypto-miners for over a year.
- Wiz says unauthenticated Spring Boot Actuator endpoints can expose heap dumps containing credentials and session cookies, or enable SSRF through Spring Cloud Gateway routes.
- Wiz describes PostgreSQL attackers combining weak credentials with COPY FROM PROGRAM to execute commands; it says the DreamBus botnet uses this approach to install crypto-miners and scan for more victims.
- The article recommends keeping an up-to-date asset inventory, proactively scanning public-facing systems, adding misconfiguration checks to CI/CD, and providing secure-by-default templates.
- Wiz also promotes its own scanning and runtime detection products for finding exposed services and suspicious activity.
Article Details
- Topic
- Exploitation of cloud application misconfigurations
MITRE ATT&CK
T1059.006 · PythonAttackers can use Selenium Grid to invoke the Python interpreter with the -c option to execute commands.T1110 · Brute ForceThe DreamBus botnet scans for PostgreSQL servers using common credentials.T1190 · Exploit Public-Facing ApplicationAttackers exploit publicly exposed and misconfigured services, including Selenium Grid and PostgreSQL, to gain access and execute commands.
Threat Actors
Products
PostgreSQLCase Study 3: PostgreSQL – COPY Your Way to Code ExecutionSelenium GridCase Study 1: Selenium Grid – Browser Automation as a BackdoorSpring Boot ActuatorCase Study 2: Spring Boot Actuator - SSRF & Heap Dumps as a ServiceSpring Cloud GatewayThe abuse path (part 2): When Spring Cloud Gateway is enabled, the /actuator/gateway endpoint allows creating new routes.