AWS RDS Vulnerability Leads to AWS Internal Service Credentials
11-Apr-22
By exploiting a local file read vulnerability on the RDS EC2 instance utilising the log fdw extension, Lightspin’s Research Team was able to gain access to an internal AWS service. The internal AWS service was linked to the RDS service using an AWS internal account.
The vulnerability was reported to the AWS Security team, who quickly issued an early patch that only affected the most recent RDS and Aurora PostgreSQL engines, leaving previous versions unaffected. Read More…
