ishideoã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ / 2022å¹´3æœˆ17æ—¥ - ã¯ã¦ãªãƒ

ã¯ã˜ã‚ã« ã“ã‚“ã«ã¡ã¯ã€æ ªå¼ä¼šç¤¾Flatt Security ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ã®æ£®å²¡(@scgajge12)ã§ã™ã€‚ æœ¬ç¨¿ã§ã¯ã€AWS Lambda ã§èµ·ã“ã‚Šã†ã‚‹è„†å¼±æ€§æ”»æ’ƒã‚„ãƒªã‚¹ã‚¯ã€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾ç–ã‚’è§£èª¬ã—ã€ã‚µãƒ¼ãƒãƒ¼ãƒ¬ã‚¹ã«ãŠã‘ã‚‹ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒªã‚¹ã‚¯ã«ã¤ã„ã¦ç´¹ä»‹ã—ã¾ã™ã€‚ ã¯ã˜ã‚ã« AWS Lambda ã«ã¤ã„ã¦ ã‚µãƒ¼ãƒãƒ¼ãƒ¬ã‚¹ã«ãŠã‘ã‚‹ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒªã‚¹ã‚¯ AWS Lambda ã§èµ·ã“ã‚Šã†ã‚‹è„†å¼±æ€§æ”»æ’ƒ Lambda ã§ã®è„†å¼±æ€§æ”»æ’ƒã«ã‚ˆã‚‹ãƒªã‚¹ã‚¯ è„†å¼±æ€§æ”»æ’ƒã«ã‚ˆã‚‹æ›´ãªã‚‹ãƒªã‚¹ã‚¯ OS Command Injection XML External Entity (XXE) Insecure Deserialization Server Side Request Forgery (SSRF) Remote Code Execution (RCE) AWS Lambda ã«ãŠã‘ã‚‹ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾ç– ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯