{"id":56780,"date":"2024-08-08T13:43:15","date_gmt":"2024-08-08T13:43:15","guid":{"rendered":"https:\/\/packetstormsecurity.com\/news\/view\/36195\/Critical-Vulnerabilities-In-6-AWS-Services-Disclosed-At-Black-Hat-USA.html"},"modified":"2024-08-08T13:43:15","modified_gmt":"2024-08-08T13:43:15","slug":"critical-vulnerabilities-in-6-aws-services-disclosed-at-black-hat-usa","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/critical-vulnerabilities-in-6-aws-services-disclosed-at-black-hat-usa\/","title":{"rendered":"Critical Vulnerabilities In 6 AWS Services Disclosed At Black Hat USA"},"content":{"rendered":"
<\/div>\n

Critical vulnerabilities in six services under Amazon Web Services (AWS) could have enabled account takeover, remote code execution, AI data manipulation, sensitive information disclosure and more, researchers from Aqua Security disclosed at Black Hat USA on Wednesday.<\/p>\n

The discoveries by Aqua Security\u2019s Nautilus research team were presented in the session \u201cBreaching AWS Accounts Through Shadow Resources<\/a>\u201d Wednesday morning at the cybersecurity conference held this year in Las Vegas. The research was presented by Lead Security Researcher Yakir Kadkoda and Senior Security Researcher Ofek Itach, of Aqua Security, and former Aqua Security Researcher Michael Katchinskiy.<\/p>\n

[For up-to-the-minute Black Hat USA coverage by SC Media, Security Weekly and CyberRisk TV visit our spotlight Black Hat USA 2024 coverage page<\/a>.]<\/strong><\/p>\n

“AWS is aware of this research. We can confirm that we have fixed this issue, all services are operating as expected, and no customer action is required,” an AWS spokesperson told SC Media.<\/p>\n

The \u201cShadow Resources\u201d attack vector, which has since been addressed by AWS, stemmed from the automatic generation of S3 buckets by various AWS services, including CloudFormation, Glue, EMR, SageMaker, ServiceCatalog and CodeStar. Users may not be aware that these buckets are being created when they start a new project or file upload, and the bucket names follow a predictable naming scheme that could be exploited by an attacker.<\/p>\n

First discovered in the CloudFormation service and later identified in the five other services through further investigation, the Shadow Resources flaw enabled an attacker to create their own S3 bucket using the predetermined name of a bucket yet to be created by the target. For CloudFormation, auto-generated S3 buckets followed a naming format that included a service-wide fixed prefix, a unique hash that remains consistent for a given AWS account, and the region that the bucket was created from.<\/p>\n

Therefore, if an attacker knew the target\u2019s unique hash, they could create a bucket including the CloudFormation prefix, the hash and any of the 33 AWS regions. No two S3 buckets can have the same name across any accounts, so when the targeted user\u2019s account attempts to create a new bucket with the name claimed by the attacker, it will result in an error \u2013 or worse.<\/p>\n

AWS flaws allowed attackers to \u2018squat\u2019 in other users\u2019 \u2018shadow buckets\u2019<\/h2>\n

The researchers found that, in the case of CloudFormation, attempting to upload a template file from a region where an attacker has already claimed the predicted bucket name would cause the template to be placed in the attacker\u2019s bucket, but only if the attacker configured the bucket to allow public access and read and write permissions for the CloudFormation service.<\/p>\n

By gaining access to the victim\u2019s uploaded file, not only could the attacker steal potentially sensitive information stored in the template, but they could also manipulate the template to inject a backdoor, leading to potential account takeover. This could be done using a Lambda function that takes advantage of the time between initial template upload and template execution to automatically inject a backdoor as soon as the template is placed in the attacker\u2019s bucket.<\/p>\n

The backdoor described by the researchers is in the form of a new admin role that can later be assumed by the attacker. However, the researchers note that such a backdoor can only be created if the victim user who uploaded the template, via the AWS Management Console, has permissions to create new admin roles.<\/p>\n

Due to the vulnerability, attackers could essentially squat in \u201cshadow buckets\u201d automatically created by CloudFormation and potentially unknown to the target themselves, simply waiting for the target to create a new CloudFormation stack in a new region for the first time, triggering the Lambda function and backdoor injection.<\/p>\n

\u201cWhile this process can take some time, you need to consider that in big organizations with hundreds of accounts and thousands of users the probability of occurrence is high,\u201d the researchers noted in a blog post.<\/p>\n

Several AWS services previously vulnerable to \u2018Shadow Resources,\u2019 \u2018Bucket Monopoly\u2019 attacks<\/h2>\n

Following their discovery of the \u201cShadow Resources\u201d vulnerability in AWS CloudFormation, the researchers expanded their investigation to other AWS services and discovered that the Glue, EMR, SageMaker, ServiceCatalog and CodeStar services were also affected by their own versions of the flaw.<\/p>\n

All of these services created \u201cshadow buckets\u201d to store certain resources upon a new user action, such as creating a new Glue job, new EMR Studio or new SageMaker Canvas, and these buckets had predictable names including fixed prefixes, AWS account IDs and region codes.<\/p>\n

Depending on the service, exploitation of the vulnerability could result in different impacts: manipulating the code of Glue jobs could lead to remote code execution (RCE), injecting code into Jupyter notebooks uploaded by EMR could enable cross-site scripting (XSS) attacks, reading and writing of SageMaker datasets could lead to theft or manipulation of AI training datasets and squatting of CodeStar S3 buckets can lead to denial-of-service (DoS) due to the inability to create new projects using another account\u2019s bucket.<\/p>\n

Attackers could improve the success rate of their attacks by creating what the researchers called a \u201cBucket Monopoly,\u201d claiming the names of all possible buckets in all regions for any known user hash or account ID. This way, any new bucket generated in any region by the target would lead to an attacker-controlled bucket.<\/p>\n

Aqua Security first reported these flaws to the AWS security team in February 2024, prompting a swift response that concluded with full resolution of all vulnerabilities by June 2024.<\/p>\n

AWS account IDs, unique hashes should be treated as secrets<\/h2>\n

Although the \u201cShadow Resources\u201d vulnerabilities have been addressed by AWS, the researchers note that their findings demonstrate the importance of treating potential identifiers, such as AWS account IDs, as secrets. The Shadow Resources and Bucket Monopoly attackers rely on the attacker obtaining either the account ID or unique CloudFormation bucket hash of the victim, meaning that protecting these values could effectively prevent the attacks.<\/p>\n

The researchers were able to discover many exposed CloudFormation hashes and AWS account IDs by conducting regex searches on GitHub, and large lists of known AWS account IDs are also available online, showing the scope of the threat posed by the now-resolved vulnerabilities. S3 bucket squatting may still be a concern, however, as some open-source AWS integrations also automatically generate S3 buckets that may have similarly predictable names. In order to prevent exploitation of similar, not yet identified flaws in open-source integrations and other services, the researchers recommend users avoid exposing their account IDs and hashes, implement the aws:ResourceAccount condition to ensure services avoid using buckets owned by other accounts, verify the ownership of buckets used by their services and use unique names for S3 buckets whenever possible, rather than predictable names following known naming conventions.<\/p>\n

Also, since the potential for account takeover using this vulnerability was dependent on the permission level of the user whose action triggered use of the attacker’s S3 bucket, this demonstrates the importance of following least privilege principles when assigning roles to users.<\/p>\n

[For up-to-the-minute Black Hat USA coverage by SC Media, Security Weekly and CyberRisk TV visit our spotlight Black Hat USA 2024 coverage page<\/a>.]<\/strong><\/p>\n

READ MORE HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

READ MORE HERE…<\/p>\n","protected":false},"author":2,"featured_media":56781,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[277],"tags":[11003],"class_list":["post-56780","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity-blogs","tag-headlinehackeramazondata-lossflawconference"],"yoast_head":"\nCritical Vulnerabilities In 6 AWS Services Disclosed At Black Hat USA 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/critical-vulnerabilities-in-6-aws-services-disclosed-at-black-hat-usa\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Critical Vulnerabilities In 6 AWS Services Disclosed At Black Hat USA 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/critical-vulnerabilities-in-6-aws-services-disclosed-at-black-hat-usa\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2024-08-08T13:43:15+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/files.scmagazine.com\/wp-content\/uploads\/2024\/08\/AdobeStock_534752160_Editorial_Use_Only.jpg\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/critical-vulnerabilities-in-6-aws-services-disclosed-at-black-hat-usa\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/critical-vulnerabilities-in-6-aws-services-disclosed-at-black-hat-usa\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"Critical Vulnerabilities In 6 AWS Services Disclosed At Black Hat USA\",\"datePublished\":\"2024-08-08T13:43:15+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/critical-vulnerabilities-in-6-aws-services-disclosed-at-black-hat-usa\\\/\"},\"wordCount\":1198,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/critical-vulnerabilities-in-6-aws-services-disclosed-at-black-hat-usa\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2024\\\/08\\\/critical-vulnerabilities-in-6-aws-services-disclosed-at-black-hat-usa.jpg\",\"keywords\":[\"headline,hacker,amazon,data loss,flaw,conference\"],\"articleSection\":[\"CyberSecurity Blogs\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/critical-vulnerabilities-in-6-aws-services-disclosed-at-black-hat-usa\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/critical-vulnerabilities-in-6-aws-services-disclosed-at-black-hat-usa\\\/\",\"name\":\"Critical Vulnerabilities In 6 AWS Services Disclosed At Black Hat USA 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/critical-vulnerabilities-in-6-aws-services-disclosed-at-black-hat-usa\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/critical-vulnerabilities-in-6-aws-services-disclosed-at-black-hat-usa\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2024\\\/08\\\/critical-vulnerabilities-in-6-aws-services-disclosed-at-black-hat-usa.jpg\",\"datePublished\":\"2024-08-08T13:43:15+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/critical-vulnerabilities-in-6-aws-services-disclosed-at-black-hat-usa\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/critical-vulnerabilities-in-6-aws-services-disclosed-at-black-hat-usa\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/critical-vulnerabilities-in-6-aws-services-disclosed-at-black-hat-usa\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2024\\\/08\\\/critical-vulnerabilities-in-6-aws-services-disclosed-at-black-hat-usa.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2024\\\/08\\\/critical-vulnerabilities-in-6-aws-services-disclosed-at-black-hat-usa.jpg\",\"width\":800,\"height\":567},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/critical-vulnerabilities-in-6-aws-services-disclosed-at-black-hat-usa\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"headline,hacker,amazon,data loss,flaw,conference\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/tag\\\/headlinehackeramazondata-lossflawconference\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Critical Vulnerabilities In 6 AWS Services Disclosed At Black Hat USA\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Critical Vulnerabilities In 6 AWS Services Disclosed At Black Hat USA 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/critical-vulnerabilities-in-6-aws-services-disclosed-at-black-hat-usa\/","og_locale":"en_US","og_type":"article","og_title":"Critical Vulnerabilities In 6 AWS Services Disclosed At Black Hat USA 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/critical-vulnerabilities-in-6-aws-services-disclosed-at-black-hat-usa\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2024-08-08T13:43:15+00:00","og_image":[{"url":"https:\/\/files.scmagazine.com\/wp-content\/uploads\/2024\/08\/AdobeStock_534752160_Editorial_Use_Only.jpg","type":"","width":"","height":""}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/critical-vulnerabilities-in-6-aws-services-disclosed-at-black-hat-usa\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/critical-vulnerabilities-in-6-aws-services-disclosed-at-black-hat-usa\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"Critical Vulnerabilities In 6 AWS Services Disclosed At Black Hat USA","datePublished":"2024-08-08T13:43:15+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/critical-vulnerabilities-in-6-aws-services-disclosed-at-black-hat-usa\/"},"wordCount":1198,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/critical-vulnerabilities-in-6-aws-services-disclosed-at-black-hat-usa\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2024\/08\/critical-vulnerabilities-in-6-aws-services-disclosed-at-black-hat-usa.jpg","keywords":["headline,hacker,amazon,data loss,flaw,conference"],"articleSection":["CyberSecurity Blogs"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/critical-vulnerabilities-in-6-aws-services-disclosed-at-black-hat-usa\/","url":"https:\/\/www.threatshub.org\/blog\/critical-vulnerabilities-in-6-aws-services-disclosed-at-black-hat-usa\/","name":"Critical Vulnerabilities In 6 AWS Services Disclosed At Black Hat USA 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/critical-vulnerabilities-in-6-aws-services-disclosed-at-black-hat-usa\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/critical-vulnerabilities-in-6-aws-services-disclosed-at-black-hat-usa\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2024\/08\/critical-vulnerabilities-in-6-aws-services-disclosed-at-black-hat-usa.jpg","datePublished":"2024-08-08T13:43:15+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/critical-vulnerabilities-in-6-aws-services-disclosed-at-black-hat-usa\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/critical-vulnerabilities-in-6-aws-services-disclosed-at-black-hat-usa\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/critical-vulnerabilities-in-6-aws-services-disclosed-at-black-hat-usa\/#primaryimage","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2024\/08\/critical-vulnerabilities-in-6-aws-services-disclosed-at-black-hat-usa.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2024\/08\/critical-vulnerabilities-in-6-aws-services-disclosed-at-black-hat-usa.jpg","width":800,"height":567},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/critical-vulnerabilities-in-6-aws-services-disclosed-at-black-hat-usa\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"headline,hacker,amazon,data loss,flaw,conference","item":"https:\/\/www.threatshub.org\/blog\/tag\/headlinehackeramazondata-lossflawconference\/"},{"@type":"ListItem","position":3,"name":"Critical Vulnerabilities In 6 AWS Services Disclosed At Black Hat USA"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/56780","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=56780"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/56780\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media\/56781"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=56780"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=56780"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=56780"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}