{"id":16978,"date":"2025-04-28T11:32:32","date_gmt":"2025-04-28T11:32:32","guid":{"rendered":"https:\/\/fusionmindlabs.com\/blogs\/5-real-vulns-explored\/"},"modified":"2025-04-28T11:32:33","modified_gmt":"2025-04-28T11:32:33","slug":"5-real-vulns-explored","status":"publish","type":"post","link":"https:\/\/fusionmindlabs.com\/blogs\/5-real-vulns-explored\/","title":{"rendered":"5 Real Vulns Explored"},"content":{"rendered":"\n<\/p>\n
\n
\n <\/p>\n

<\/a>\n <\/div>\n

Not all security vulnerabilities are high-risk on their own; however, in the hands of a sophisticated attacker, even minor weaknesses can escalate into significant breaches. The following five real-world vulnerabilities, identified by Intruder’s<\/a> bug-hunting team, demonstrate how attackers can transform overlooked flaws into serious security incidents.<\/p>\n

1. Stealing AWS Credentials via Redirect<\/strong><\/h2>\n
    \n <\/ol>\n

    Server-Side Request Forgery (SSRF) is a common vulnerability with significant potential impact, particularly in cloud-hosted applications. If a web application fetches resources from user-supplied URLs, precautions should be taken to prevent attackers from manipulating requests to access unintended resources.<\/p>\n\n

    The attack chain proceeded as follows: the application sent a webhook request to the attacker’s web server, which responded with a 302 redirect to AWS’s metadata service. The application followed the redirect and logged the response, exposing sensitive metadata, including AWS credentials.<\/p>\n\n

    This attack would not have been possible if the metadata service had been enforcing IMDSv2<\/a>, a best practice that a good cloud security scanner<\/a> would have flagged. Although automated tools might not have detected the full attack chain, breaking just this part of the chain could have prevented exploitation.<\/p>\n

    2. From Exposed .git Repository to Full Database Access<\/strong><\/h2>\n
      \n <\/ol>\n\n

      Upon reviewing the application’s source code, we uncovered an authentication bypass – the login page could be accessed by supplying a hidden parameter.<\/p>\n\n

      Exploiting this vulnerability granted access to a university’s database, which, if leveraged by an attacker, could have exposed sensitive personal information of students and staff, demonstrating how a small misconfiguration can quickly escalate into a major security risk.<\/p>\n

      3. How a Tiny Detail Led to Remote Code Execution<\/strong><\/h2>\n
        \n <\/ol>\n\nCVE-2021-22204<\/a>. By creating and uploading a malicious PDF, our team successfully gained remote command execution as the www-data user.<\/p>\n\n

        4. From Self-XSS to Site-Wide Account Takeover<\/strong><\/h2>\n
          \n <\/ol>\n\n\n\n\n\n

          5. Changing a Number to Expose Sensitive Data<\/strong><\/h2>\n
            \n <\/ol>\n\n\n\n