Automating security assessments using Cloud Katana

Today, we are open sourcing Cloud Katana, a cloud-native serverless application built on the top of Azure Functions to assess security controls in the cloud and hybrid cloud environments. We are currently covering only use cases in Azure, but we are working on extending it to other cloud provider...

Privilege Escalation

serverless-offline is vulnerable to privilege escalation. The vulnerability exists in createAuthScheme function of createAuthScheme.js due to an insecure access control from a misinterpreted HTTP status code which allows an attacker to download a web content page via malicious URL...

CVE-2021-38384

Serverless Offline 8.0.0 returns a 403 HTTP status code for a route that has a trailing / character, which might cause a developer to implement incorrect access control, because the actual behavior within the Amazon AWS environment is a 200 HTTP status code i.e., possibly greater than expected...

CVE-2021-38384

Serverless Offline 8.0.0 returns a 403 HTTP status code for a route that has a trailing / character, which might cause a developer to implement incorrect access control, because the actual behavior within the Amazon AWS environment is a 200 HTTP status code i.e., possibly greater than expected...

Improper access control

Serverless Offline 8.0.0 returns a 403 HTTP status code for a route that has a trailing / character, which might cause a developer to implement incorrect access control, because the actual behavior within the Amazon AWS environment is a 200 HTTP status code i.e., possibly greater than expected...

CVE-2021-38384

CVE-2021-38384 affects Serverless Offline 8.0.0. The issue is that a route with a trailing / may yield a 403 in some contexts, while AWS/Lambda behavior can be 200, potentially granting higher permissions than intended due to an insecure access control interpretation. Root cause described as a mi...

CVE-2021-38384

Serverless Offline 8.0.0 returns a 403 HTTP status code for a route that has a trailing / character, which might cause a developer to implement incorrect access control, because the actual behavior within the Amazon AWS environment is a 200 HTTP status code i.e., possibly greater than expected...

serverless安全漏洞

Serverless is a software application. Is this in order to be the one that contains all the official repo AWS Serverless architecture patterns built with the CDK? A security vulnerability exists in Serverless 8.0.0 that could cause developers to implement incorrect access controls...

CVE-2021-38384: Improper Handling of Exceptional Conditions

Serverless Offline 8.0.0 returns a 403 HTTP status code for a route that has a trailing / character, which might cause a developer to implement incorrect access control, because the actual behavior within the Amazon AWS environment is a 200 HTTP status code i.e., possibly greater than expected...

Secure Your Images with AWS Lambda Serverless Functions

NEW on AWS Lambda: Learn how to package up your serverless functions as container images...

Moderate: Red Hat Security Advisory: Release of OpenShift Serverless 1.16.0

Release of OpenShift Serverless 1.16.0 Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References...

Moderate: Red Hat Security Advisory: Release of OpenShift Serverless Client kn 1.16.0

Release of OpenShift Serverless Client kn 1.16.0 Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...

Moving to AWS Lambda? Here’s what you need to know.

Serverless computing is transforming the way organizations build, ship, automate and scale applications. With no need to worry about infrastructure or who’s going to manage it, developers are free to focus on application development and innovation. The payoffs can be significant: Faster time to...

Security for AWS Lambda Serverless Applications

Serverless computing is another beautiful cloud-based advancement for developers. But, like all applications, proper security is required to maximize the benefits. Learn more in this article...

Mitigating attacks in serverless environments

Serverless computing has become the fastest-growing segment in the cloud services market. The benefits are clear and significant: cost savings and lower operational overhead, giving development teams full control over code and flexibility in the infrastructure. This also means that, in terms of...

@apalchys/serverless-openapi-documentation (>=0.1.0, <=0.5.4), @conqa/serverless-openapi-documentation (>=1.0.1, <=1.0.4) +27 more potentially affected by CVE-2021-23396 via lutils (>=0.2.11, <=2.4.0)

lutils NPM version =0.2.11, =0.1.0, =1.0.1, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =2.0.9, =0.3.0, =0.0.1, =0.1.9 and more Source cves: CVE-2021-23396 Source advisory: SNYK:JS-LUTILS-1311023...

Platform Update: Akamai Boosts Edge Application Power, Expanding Possibilities for Developers

Welcome to the Akamai Platform Update -- two days of new capabilities and innovations across our edge technology and security product portfolios. Today, we look at our edge technology products, which include edge computing, edge delivery CDN, and other complementary products and services that hel...

Now Available: EdgeKV Distributed Key-Value Store

We're excited to announce the availability of EdgeKV, a distributed key-value store database that enables EdgeWorkers to leverage data stored at the edge when deploying custom code across our serverless computing platform. This solution is fully distributed, meaning it runs in 1,400+ networks and...

Now Available: EdgeKV Distributed Key-Value Store

We're excited to announce the availability of EdgeKV, a distributed key-value store database that enables EdgeWorkers to leverage data stored at the edge when deploying custom code across our serverless computing platform...

How Enigmo Moved Logic from Client to Origin to Edge

By: Hideki Ito Enigmo owns BUYMA, a Japanese fashion C2C marketplace that helps people buy and sell high-quality goods from overseas on www.buyma.com. BUYMA has 8.21 million members and deals with 5.62 million items across 140,000 fashion brands. Its website uses EdgeWorkers to manipulate cookies...