I bypassed AWS API Gateway auth with a trailing slash. Got $12K bounty
%2520(1).png&w=1024)
A security researcher discovered a vulnerability in a fintech's mobile API that allowed unauthorized access to account data. By exploiting a flaw in the AWS HTTP API's path matching, the researcher was able to bypass authentication checks and retrieve sensitive information. The issue was reported and promptly fixed, resulting in a $12,000 bounty for the researcher.
- ▪The API returned different responses based on the presence of a trailing slash in the URL.
- ▪The researcher was able to access account data and initiate transfers without valid authentication.
- ▪The fintech company fixed the vulnerability by switching to a stricter API and adding user validation.
Opening excerpt (first ~120 words) tap to expand
I was poking at a fintech’s mobile API and noticed something that made no sense. GET /v1/accounts returned 401. GET /v1/accounts/ returned 200 with full account data. One character. Completely different security posture.What I was looking atThe API ran on AWS HTTP API — the newer, cheaper alternative to REST API. Lambda authorizer checked a JWT against Cognito, returned an IAM policy. Standard.Routes in OpenAPI:YAML/v1/accounts: get: x-amazon-apigateway-integration: uri: arn:aws:apigateway:... /v1/accounts/{accountId}: get: x-amazon-apigateway-integration: uri: arn:aws:apigateway:...The authorizer ran on every request.
…
Excerpt limited to ~120 words for fair-use compliance. The full article is at Blogspot.
Discussion
0 commentsMore from Blogspot
