AWS Serverless Repository Service

Reported Context (3)

to read objects from S3 buckets integrated with itOne of the vulnerable services was the AWS Serverless Repository Service. The policy provided by Amazon for its users lacked scoping conditions, and the Serverless Wiz Calls for a Standardized Cloud Vulnerability Database, Later Launches Open CVDB
So we were surprised to discover that in some cases, AWS services (CloudTrail, AWS Config and Serverless Repository) could be manipulated to give anyone access to the specific resources of other customers. Wiz Details Three AWS Cross-Account Vulnerabilities and Their Root Cause
The vulnerabilities have been proven on three major AWS services (AWS Config, Cloudtrail, and Serverless Repository) and have allowed a potential attacker to write and read certain objects from private S3 buckets. Black Hat 2021: 10 Cybersecurity Sessions to Watch

Vendors (4)

Products (13)

Tools (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.