Discover and read the best of Twitter Threads about #hellskeychain
Most recents (1)
We found a Remote Code Execution vulnerability in every #PostgreSQL database in #IBMCloud 😱
Here is how we did it: 🧵
#HellsKeychain
Here is how we did it: 🧵
#HellsKeychain
We set up a PostgreSQL instance in IBM Cloud and tried to execute code using the 'COPY FROM PROGRAM' statement. Unfortunately, this failed due to insufficient privileges. We were blocked! 🚫
We reviewed all IBM Cloud's proprietary functions that had the 'security definer' flag (meaning they will run as superuser). One of these functions had a SQL Injection vulnerability that we were able to exploit:
