Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I bypassed AWS API Gateway auth with a trailing slash. Got $12K bounty

theguptalog.blogspot.com

Post reply on HN
Print view View original

21–30 of 45 posts

Re: I bypassed AWS API Gateway auth with a trailing slash. Got $12K bounty

#21

Post by Kwpolska »

savolai wrote: post #11
tedk-42 wrote: post #5

Hmmm 12K seems like a bit much, even if it's fintech. They also didn't mention the company. The title feels clickbaity as it's not specific to AWS API gateway and instead, the implementation of it. And who hosts on blogspot...

It's not really fair to criticise hosting choice, but this lead me down a rabbit hole. Noticed that non-responsive blog layouts are rare these days. Most are from blogspot. So I took a look and realized that blogger nowadays actually supports responsive layouts, but apparently... they are not popular? https://blogger.googleblog.com/2017/03/share-your-unique-sty...

Google barely maintains Blogger, and people have old blogs with old templates they never felt the need to change.

Re: I bypassed AWS API Gateway auth with a trailing slash. Got $12K bounty

#22

Post by fiedzia »

stuartjohnson12 wrote: post #8
sammy2255 wrote: post #7

Did you Bypass AWS API Gateway.. or did you bypass it for a company who had their AWS API Gateway misconfigured?

I hate when people say this, as if there's any world in which I would want my AWS API gateway to do this, let alone accidentally. HTTP is littered with these footguns, differences between slashes and no slashes is a classic. A good piece of software would make it hard to do this by accident, and probably should default to having the same behaviour with or without trailing slash. Yes yes, I know, folder/file naming co…

> A good piece of software would make it hard to do this by accident, and probably should default to having the same behaviour with or without trailing slash.

Django redirects one version to another by default, which achieves that.

Re: I bypassed AWS API Gateway auth with a trailing slash. Got $12K bounty

#24

Post by sillysaurusx »

praptak wrote: post #18

Appending stuff to bypass blacklists is eternal. My first job, decades ago. I couldn't update something on my laptop because client's gateway blocked ` http://foo.com/update.exe `. Guess what, ` http://foo.com/update.exe ?` worked as a bypass.

Ah, a rare situation where you have to put your URL in angle brackets for it to be parsed correctly here: http://foo.com/update.exe?> (Not that it matters in this case. Also I would’ve guessed the angle brackets would disappear, but apparently not.)

[1] https://news.ycombinator.com/formatdoc

Re: I bypassed AWS API Gateway auth with a trailing slash. Got $12K bounty

#25

Post by varispeed »

tedk-42 wrote: post #5

Hmmm 12K seems like a bit much, even if it's fintech. They also didn't mention the company. The title feels clickbaity as it's not specific to AWS API gateway and instead, the implementation of it. And who hosts on blogspot...

Exactly. What do these researchers think? Getting rich finding security flaws? They should get $5 at best, buy themselves chocolate bar and an orange juice and be grateful for the opportunity bestowed upon them by the rich.

Re: I bypassed AWS API Gateway auth with a trailing slash. Got $12K bounty

#26

Post by sillysaurusx »

treszkai wrote: post #17
tedk-42 wrote: post #5

Hmmm 12K seems like a bit much, even if it's fintech. They also didn't mention the company. The title feels clickbaity as it's not specific to AWS API gateway and instead, the implementation of it. And who hosts on blogspot...

Yes, it and the other three posts sound positively AI written. The first post on the blog is how OP uploaded a backdoored dataset to HuggingFace and left it there for 6 months – whether made up or not, it doesn't sound great.

Why not?

This is arguing for style over substance. The goal is to explain how a bug impacts the company. Anything that achieves the goal is de facto good. Remember, the alternative is for the company not to be notified at all.

Re: I bypassed AWS API Gateway auth with a trailing slash. Got $12K bounty

#27

Post by elpocko »

praptak wrote: post #18

Appending stuff to bypass blacklists is eternal. My first job, decades ago. I couldn't update something on my laptop because client's gateway blocked ` http://foo.com/update.exe `. Guess what, ` http://foo.com/update.exe ?` worked as a bypass.

A DPI firewall at a place of education had a whitelist of allowed domains that you could connect to from the internal network. One entry in the whitelist was "microsoft.com".

I installed a web proxy on my VPS, which was accessible under a domain name like "computerthings.example", created a subdomain called "microsoft", and voila: "microsoft.computerthings.example" was good enough to match "^microsoft.com.*" and allowed us to bypass the block for the next two years.

Post reply on HN