Later archive addition

All Your Clouds Are Belong to Us: Security Analysis of Cloud Management Interfaces

Juraj Somorovsky, Mario Heiderich, Meiko Jensen, Jörg Schwenk, Nils Gruschka and Luigi Lo Iacono

Researchers attacked the cloud control interfaces of Amazon EC2/S3 and Eucalyptus. Four XML Signature wrapping variants let a single eavesdropped SOAP request trigger arbitrary operations, and a signature-exclusion bug authorised requests carrying only a public X.509 certificate. Persistent XSS in the Amazon shop reached the AWS console through shared login sessions.

Record

Researcher

Juraj Somorovsky, Mario Heiderich, Meiko Jensen, Jörg Schwenk, Nils Gruschka and Luigi Lo Iacono

Format

Whitepaper

In the archive

• Added to the 2011 archive after the original list was published

Tags

• aws
• soap
• parser-differential
• auth-bypass
• xss
• sso
• case-study
• owasp-a01-2021
• owasp-a03-2021
• owasp-a07-2021

This page is the archive's own catalogue record. The research is the work of Juraj Somorovsky, Mario Heiderich, Meiko Jensen, Jörg Schwenk, Nils Gruschka and Luigi Lo Iacono, first published at the original source. Preserved copies are kept so the citation survives its host.