AWS VDP · Report #2731133

External service interaction (HTTP)

Validstatus

highseverity

62upvotes

4 Oct 2024disclosed

Summary

Thank you for bringing this issue to our attention. Upon review, we identified that the related infrastructure was previously deprecated, and it seems that this particular test resource was unintentionally overlooked during the process.

While the finding is outside the scope of the program (not related to AWS Software or Services), we appreciate the report and will proceed to close the report as resolved.

Thanks again for your report and for helping us protect our customers! Please feel free to reach out if you have any further questions or concerns.

How it was found

There is External service interaction ( DNS and HTTP ) vulnerability in url : ████ in this video ██████████

Impact

The External Service Interaction arise when it is possible for a attacker to induce application to interact with the arbitrary external service such as DNS HTTP etc. The External Service Interaction can is not limited to HTTP,HTTPS or DNS, you can lead to FTP, SMTP etc. Such weakness can lead to DDoS attack. The External Service Interaction can lead to OS Command Injection, DOS Attack, DDOS Attack or Code Manipulation

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original