Taking over “Google Cloud Shell” by utilizing capabilities and Kubelet
Target Program: -
🎯 Vulnerability: Remote Code Execution (RCE)
💡 Defense Fix: Avoid executing shell commands via system(). Use parameterized APIs and strict input sanitization.
More Writeups Like This
pentester.land
by Quang Vo (@mr_r3bot)Red team: Journey from RCE to have total control of cloud infrastructure
pentester.land
by Ronen Shustin (@ronenshh), Shir Tamari (@shirtamari)#BrokenSesame: Accidental ‘write’ permissions to private registry allowed potential RCE to Alibaba Cloud Database Services
pentester.land
by Ori Hollander, Shachar Menashe, Natan Nehorai, Uriya YavnieliFrom MLOps to MLOops: Exposing the Attack Surface of Machine Learning Platforms
pentester.land
by Karl Fosaaen (@kfosaaen)