SSRF vulnerability found in Google Cloud


SSRF vulnerability found in Google Cloud: Server-side request forgery (also known as SSRF) is a web security vulnerability that allows an attacker to induce the server-side application to make HTTP requests to an arbitrary domain of the attacker's choosing.

 

It is a type of attack by the name SSRF, the attacker might cause the server to make a connection to internal-only services within the organization's infrastructure. In other cases, they may be able to force the server to connect to arbitrary external systems, potentially leaking sensitive data such as authorization credentials.

 

A URL parsing bug left an internal Google Cloud project open to server-side request forgery (SSRF) attacks, security researcher David Schütz has found. Now fixed, the bug, which Schütz has documented in a comprehensive video and blog post, could have allowed an attacker to access sensitive resources and possibly run malicious code.

 

Schütz found the bug while doing research on Discovery Documents, data structures that provide specifications for Google API services. While exploring the Discovery Documents, Schütz stumbled on an interesting service called Jobs API, whose name suggested it was an internal service...Read More

Comments

Post a Comment

Popular posts from this blog

N Chandrasekaran appointed chairman of Tata Sons

Image
The board of directors of Tata Sons, at its meeting has unanimously appointed N Chandrasekaran as executive chairman, Tata Sons. N Chandrasekaran shall take charge from February 21, 2017. The board of Tata Sons said, “Chandrasekaran has demonstrated exemplary leadership as the chief executive officer and managing director, Tata Consultancy Services. We believe he will now inspire the entire Tata group to realise its potential acting as leaders in their respective businesses, always in keeping with our value system and ethics and adhering with the practices of the Tata group which have stood it in good stead.” Chandrasekaran was the chief executive officer and managing director of Tata Consultancy Services since 2009. A Tata lifer, he had joined the company in 1987 and was appointed as a director on the board of Tata Sons on October 25, 2016.
Read more

DoT Secretary hints at making Draft NTP 2018 available in public domain soon

Image
“A draft National Telecom Policy 2018 that is liberal and non-prescriptive in its licensing approach in Machine to Machine (M2M) communication is being given final touches. The policy should be in the public domain in the next two to three weeks for discussion and responses from stakeholders,” said Aruna Sundararajan, Secretary, Department of Telecom, Ministry of Communications. Aruna Sundararajan said, “M2M is the next big opportunity for India in terms of its impact and the quantum change that it will bring about in the quality of services and delivery. The favourable impact of M2M on job creation had already set in as seen by the arrival of the first set of start-ups in the areas such as agriculture, smart cities, healthcare and water management.” She stressed that NTP 2018 would be transformative in harnessing the full benefits of M2M communications. She further said that in the M2M framework the focus would be on low-cost manufacturing, where exciting innovatio
Read more

Visa buys NFT based CryptoPunk and paid $150,000 in Etherium

Image
Visa buys NFT based CryptoPunk and paid $150,000 in Etherium:  Leader in the digital payments   Visa   has purchased a digital CryptoPunk for $150,000, marking the company's first ever   NFT   purchase. The deal is clearly shows that, Visa is stepping into the world of NFTs with its purchase of   CryptoPunk 7610 .   Going forward, NFTs and Visa to align and integrate them in new brand strategy to gain a sizable market share. However, NFTs have often been compared to physical collectible items like rare trading cards and works of art.   The CryptoPunk 7610, which feBlatures a female punk with a mohawk and large green eyes. "We envision there could be a future where your crypto address becomes as important as your mailing address," Visa's Head of Crypto said.   An NFT - which stands for non-fungible token - is a unique digital asset designed to represent ownership of a virtual item. Unlike bitcoin and other cryptocurrencies, NFTs can’t be exchanged like-for-like with an
Read more