I bypassed AWS API Gateway auth with a trailing slash. Got $12K bounty
theguptalog.blogspot.com
I bypassed AWS API Gateway auth with a trailing slash. Got $12K bounty
1–10 of 45 posts
Re: I bypassed AWS API Gateway auth with a trailing slash. Got $12K bounty
#2$1 removing the slash,
$11,999 knowing where to remove the slash from
Re: I bypassed AWS API Gateway auth with a trailing slash. Got $12K bounty
#3Don’t vibe code your auth path folks.
Re: I bypassed AWS API Gateway auth with a trailing slash. Got $12K bounty
#4[flagged]
Re: I bypassed AWS API Gateway auth with a trailing slash. Got $12K bounty
#5Hmmm 12K seems like a bit much, even if it's fintech.
They also didn't mention the company.
The title feels clickbaity as it's not specific to AWS API gateway and instead, the implementation of it.
And who hosts on blogspot...
Re: I bypassed AWS API Gateway auth with a trailing slash. Got $12K bounty
#6Interesting story showing how complex todays tech is, and your whole security plan can be compromised by regexp matching rules.
Re: I bypassed AWS API Gateway auth with a trailing slash. Got $12K bounty
#7Did you Bypass AWS API Gateway.. or did you bypass it for a company who had their AWS API Gateway misconfigured?
Re: I bypassed AWS API Gateway auth with a trailing slash. Got $12K bounty
#8Did you Bypass AWS API Gateway.. or did you bypass it for a company who had their AWS API Gateway misconfigured?
I hate when people say this, as if there's any world in which I would want my AWS API gateway to do this, let alone accidentally. HTTP is littered with these footguns, differences between slashes and no slashes is a classic. A good piece of software would make it hard to do this by accident, and probably should default to having the same behaviour with or without trailing slash.
Yes yes, I know, folder/file naming convention dating from...
But it's current year now
Re: I bypassed AWS API Gateway auth with a trailing slash. Got $12K bounty
#9$1 removing the slash, $11,999 knowing where to remove the slash from
At that rate I would remove it from everywhere.
Re: I bypassed AWS API Gateway auth with a trailing slash. Got $12K bounty
#10The thing that absolutely should not be vibe coded, especially in fintech.
Turning a $10 bug into a $12K issue and if this was at a big tech company it would be a $120K+ issue.