Not all security vulnerabilities are high-risk on their own; however, in the hands of a sophisticated attacker, even minor weaknesses can escalate into significant breaches. The following five real-world vulnerabilities, identified by Intruder’s bug-hunting team, demonstrate how attackers can transform overlooked flaws into serious security incidents.
1. Stealing AWS Credentials via Redirect
Server-Side Request Forgery (SSRF) is a common vulnerability with significant potential impact, particularly in cloud-hosted applications. If a web application fetches resources from user-supplied URLs, precautions should be taken to prevent attackers from manipulating requests to access unintended resources.
The attack chain proceeded as follows: the application sent a webhook request to the attacker’s web server, which responded with a 302 redirect to AWS’s metadata service. The application followed the redirect and logged the response, exposing sensitive metadata, including AWS credentials.
This attack would not have been possible if the metadata service had been enforcing IMDSv2, a best practice that a good cloud security scanner would have flagged. Although automated tools might not have detected the full attack chain, breaking just this part of the chain could have prevented exploitation.
2. From Exposed .git Repository to Full Database Access
Upon reviewing the application’s source code, we uncovered an authentication bypass – the login page could be accessed by supplying a hidden parameter.
Exploiting this vulnerability granted access to a university’s database, which, if leveraged by an attacker, could have exposed sensitive personal information of students and staff, demonstrating how a small misconfiguration can quickly escalate into a major security risk.
3. How a Tiny Detail Led to Remote Code Execution
4. From Self-XSS to Site-Wide Account Takeover
5. Changing a Number to Expose Sensitive Data
- GET /organisations/edit_user?user_id=1001: The attacker could modify user profiles and hijack accounts
- GET /prod-applicantresumes/12031.pdf: The attacker could access job seekers’ CVs.
- POST /Order/Download, OrderNo=10202: The attacker could access customer order information.
Preventing Breaches Before They Start
| Source Link |
