How We Impersonated Cloud Code by Google Cloud and Took Over GCP Accounts
The Upwind security research team is constantly examining threat landscapes and potential attack paths. In one of our recent searches, we discovered an anomaly in the authentication behavior of Google Developer tools that security practitioners should be aware of. We discovered this threat landscape by running scans on GCP Cloud Code, during which we found […]
Upwind takes over ArgoCD and an EKS Cluster Using Only A Simple CSRF Vulnerability
In recent weeks, Upwind’s research team dug into Argo CD, our research revealed two batches of vulnerabilities, specifically critical security vulnerabilities in Argo CD, including Cross-Site Request Forgery (CSRF) impacting GET, POST, and PUT requests, and Remote Code Execution (RCE) capabilities. These vulnerabilities opened doors to unauthorized exposure and manipulation of sensitive data within Kubernetes […]
Reduce Attack Surfaces with Distroless Images – Part 1
Upwind pioneered a method to streamline patch management and significantly reduce vulnerabilities for Upwind users through leveraging runtime data. When it’s challenging to eliminate unneeded binaries and artifacts from applications, there are two strategies available: Both approaches aim to minimize image size and reduce the attack surface, while Distroless images require no patching, no upgrading […]
A New Deadly Combination in Nginx
Recently a deadly combination of vulnerabilities emerged, posing a severe threat to Kubernetes clusters utilizing Ingress-Nginx. By exploiting three critical vulnerabilities: attackers can execute arbitrary code and escalate privileges, all with access to the Nginx Annotation object. These vulnerabilities have been confirmed in both NGINX and Kubernetes/Ingress-Nginx, as reported by Google and various GitHub issues. […]
Why Talking with Generative AI Might Be Dangerous
Large Language Models (LLMs) have emerged as game-changers in the rapidly evolving realm of artificial intelligence. While LLMs promise revolutionary capabilities such as analyzing vast datasets, mastering language nuances, and predicting user behavior, they also raise multiple security concerns that users should be aware of. Spotlight: LangChain, the MVP of LLM-Driven Applications LangChain is a […]
Apache Pinot Vulnerability: Everything You Need to Know About the 900 Associated CVEs
During CVE research at Upwind, we encountered an unfamiliar Apache service known as Apache Pinot. Apache Pinot is a real-time distributed OnLine Analytical Processing (OLAP) datastore specifically designed to deliver low-latency responses to OLAP queries. The Apache Pinot architecture is comprised of four key components: Why Use Apache Pinot? Organizations implement Apache Pinot to enhance […]
