POJIA破甲
地图 / Amazon Kendra Intelligent Ranking Service Reporting "AWS Internal" for CloudTrail Events Generated from FIPS Endpoints

Amazon Kendra Intelligent Ranking Service Reporting "AWS Internal" for CloudTrail Events Generated from FIPS Endpoints

信息泄露 / Insufficient Logging / #3044471

厂商
AWS VDP
严重程度
低危 · CVSS 5
赏金
—
弱点
Insufficient Logging
研究员
@nick_frichette_dd
披露日期
2025-05-28
资产
All API's called by the AWS CLI
CVE
—

该报告还没有中文解读。

原文摘录

摘自原文(1786 字符中的一小部分)
**Description:** When performing calls to the AWS API, [AWS CloudTrail](https://aws.amazon.com/cloudtrail/) is responsible for logging that API activity for customers. These CloudTrail event logs contain information about the API call, when it was performed, by whom, etc.
原文中的代码
aws kendra-ranking list-rescore-execution-████ans

默认不展示报告全文。以上为简短摘录,完整复现过程请阅读原文。版权归研究员与 AWS VDP 所有。

时间线

  • 报告提交
  • 公开披露
阅读 HackerOne 原文 ↗作者 @nick_frichette_dd · 版权归作者与 AWS VDP 所有

同类报告

Non-Production API Endpoints for the Forecast Service Fail to Log to CloudTrail Resulting in Silent Permission EnumerationAWS VDP · 2025-03-24Non-Production API Endpoints for the Amazon S3 Tables Service Fails to Log to CloudTrail Resulting in Silent Permission EnumerationAWS VDP · 2026-07-02(Part 2) Non-Production API Endpoints for the Datazone Service Fail to Log to CloudTrail Resulting in Silent Permission EnumerationAWS VDP · 2025-04-08Non-Production API Endpoints for the Datazone Service Fail to Log to CloudTrail Resulting in Silent Permission EnumerationAWS VDP · 2025-02-26Non-Production API Endpoints for the DocumentDB Elastic Service Fail to Log to CloudTrail Resulting in Silent Permission EnumerationAWS VDP · 2025-03-11Non-Production API Endpoint for the ElastiCache Service Fails to Log to CloudTrail Resulting in Silent Permission EnumerationAWS VDP · 2025-04-25