Skip to content
BreachPathAttack Path LibraryStart
AdvancedData theftIntellectual-property theft

Web application flaw to cloud credentials

A flaw in an internet-facing custom application is used to reach the workload's identity, harvest cloud credentials, and pivot into the wider cloud account where production data lives.

Technologies
Custom web applications, AWS, Azure
Entry points
Vulnerable application
Sectors
SaaS & technology, Retail, Financial services…
Stages
4
01

A flaw in the internet-facing application is reached

The attacker probes the public application and finds input that is not properly validated or isolated, allowing them to influence server-side behaviour — for example coercing the server into making requests or returning data it should not.

Attacker objective

Get the application to perform actions or return data on the attacker's behalf beyond its intended function.

MITRE ATT&CK
Controls that should stop this
  • Secure development lifecycle with input validation and output encoding
  • Web application firewall tuned to the app's real traffic
  • Network egress restrictions so the workload cannot reach arbitrary destinations
What defenders should see
  • WAF and application logs showing anomalous or malformed requests
  • Unexpected outbound connections from the application server
  • Error-rate and latency anomalies during probing
What a pentest validates
  • Authenticated and unauthenticated application penetration test
  • Review of server-side request handling and input trust boundaries
  • Validate egress filtering from the application tier
Business impact

The attacker now has a way to make the trusted application act for them.

02

The workload identity is reached

Cloud workloads authenticate to the platform using an attached identity. By coercing the server into surfacing this identity material, the attacker obtains the same permissions the application uses to talk to the cloud.

Attacker objective

Reach the identity the application runs as, which cloud workloads use to call other services.

MITRE ATT&CK
Controls that should stop this
  • Enforce the hardened metadata service version that resists this coercion
  • Least-privilege roles scoped tightly to the workload's real needs
  • Short-lived credentials and no long-lived keys on instances
What defenders should see
  • Cloud audit logs showing workload-identity calls from unusual patterns
  • Use of the workload role from outside its normal service context
  • First-seen API actions for that identity
What a pentest validates
  • Test whether the app tier can be coerced into exposing its identity
  • Review the blast radius of the workload role's permissions
  • Confirm metadata-service hardening across all instances
Business impact

The attacker now holds a legitimate cloud identity belonging to the application.

03

Cloud permissions are enumerated for a path to privilege

With a valid cloud identity, the attacker enumerates what it is permitted to do — which storage it can read, which secrets it can retrieve, and whether any permission allows escalation toward wider control of the account.

Attacker objective

Understand what the stolen identity can do and find a route to broader access or data.

MITRE ATT&CK
Controls that should stop this
  • Remove escalation-prone permissions; separate duties across roles
  • Central secrets management with tight, audited access
  • Guardrails / service control policies limiting what any single role can reach
What defenders should see
  • Bursts of permission-enumeration and describe/list API calls
  • Secrets-manager access from an identity that rarely uses it
  • Access to storage or resources outside the workload's normal scope
What a pentest validates
  • Cloud security review mapping privilege-escalation paths from the workload role
  • Test secret retrieval and whether secrets unlock further access
  • Validate service control policies actually constrain lateral movement
Business impact

The attacker maps a route from one workload identity toward account-wide access.

04

Production data and secrets are accessed

Using the permissions and secrets gathered, the attacker reaches production data stores or code repositories and extracts their contents, or uses recovered secrets to authenticate to further systems.

Attacker objective

Reach and remove the customer data, source or secrets that are the real target.

MITRE ATT&CK
Controls that should stop this
  • Encryption with tightly controlled key access and object-level policies
  • Egress controls and anomaly detection on data stores
  • Immutable backups isolated from the production identity plane
What defenders should see
  • Anomalous read/download volume from production storage
  • Access to data stores from a workload role that normally only writes
  • Egress to unfamiliar destinations
What a pentest validates
  • Authorised, controlled test of reading and exfiltrating from a sample store
  • Verify detection and blocking of bulk cloud-storage reads
  • Confirm backups and keys are isolated from a compromised workload role
Business impact

Customer data, source code or secrets are exposed — a reportable breach with regulatory and commercial fallout.

ATT&CK techniques in this chain

T1078.004Valid Accounts: Cloud AccountsT1190Exploit Public-Facing ApplicationT1567.002Exfiltration Over Web Service: Cloud StorageT1530Data from Cloud StorageT1580Cloud Infrastructure DiscoveryT1552.004Unsecured Credentials: Private KeysT1552.005Unsecured Credentials: Cloud Instance Metadata API

If this chain completes

A single application weakness becomes a foothold in the cloud control plane, exposing customer data, secrets and potentially the ability to alter or destroy production infrastructure.

Should you test this against your environment?

Turn this chain into a scoped red-team brief — objective, systems and identities in scope, testing assumptions and the questions to answer before commissioning.

Generate my red-team test briefExplore more paths