Showing Articles About
cloudwatch
-
Leonidas Tsaousis - 6 Jan 2025
CloudWatch Dashboard (Over)Sharing
A security vulnerability was discovered in AWS CloudWatch dashboard sharing that allowed unauthorized viewers to access EC2 tags. The issue stemmed from a misconfiguration in Cognito Identity Pools' authentication flow, specifically an undefined setting for the Classic authentication flow. By exploiting this misconfiguration, attackers could retrieve sensitive account information through a multi-step authentication process.