219 - Rapid Reset, Attacking AWS Cognito, and Confluence Bugs [Bug Bounty Podcast]

We've got a mix of topics this week, started with a bit of discussion around the recent Rapid Reset denial of service attack, before diving into a few vulnerabilities. A Node "permissions" module escape due to having a fail-open condition when unexpected but supported types are passed in. Then we talk about some common AWS Cognito issues, a fun little privilege escalation in Confluence, and a log injection bug leading to RCE.

Links and vulnerability summaries for this episode are …

attack aws bounty bug bug bounty bugs cognito confluence denial of service denial of service attack escape fail node permissions podcast rapid rapid reset reset service topics types vulnerabilities week