The most dangerous: cloud metadata at 169.254.169.254 . A single 302 redirect → metadata endpoint returns temporary AWS credentials the attacker can use to access S3 buckets, RDS, or any other cloud resource the instance has an IAM role for. That's a complete account compromise, not just a server crash..

[–] mathemachristian@hexbear.net 4 points 1 week ago* (last edited 1 week ago) (1 children)

is this live? If it is please remove the comment and tell the devs. This could put people who already are being harassed on the regular by trolls at risk. I don't know if IP addresses are logged, not everyone uses burner email addresses etc.

I can't even mod the comment bc then it just shows up on the modlog, i'd have to remove the entire post.

[–] RedWizard@hexbear.net 4 points 1 week ago (2 children)

They patched it. This is what the threat was.

[–] mathemachristian@hexbear.net 5 points 1 week ago

Ah good

[–] floquant@lemmy.dbzer0.com 1 points 1 week ago (1 children)

It was not, that's only what deepseek said it was. I don't know why you edited the comment to hide the details of the hallucination instead of accepting that it fluked.

[–] RedWizard@hexbear.net 3 points 1 week ago

I changed it before I read your comment because a mod asked me to. Relax.

[–] floquant@lemmy.dbzer0.com 1 points 1 week ago (1 children)

Complete hallucination, this is improper validation of requests, nothing about fetching something or leaking credentials.

Also, 169.254.0.0/16 is the link-local IPv4 network so it doesn't even make sense outside of the fact that aws servers may get metadata on such networks (which again is absolutely unrelated to this diff). Is this a 3b model? Seems like it ran out of context, maybe it loaded the entire html page.

[–] RedWizard@hexbear.net 4 points 1 week ago

Yeah I'm no expert

I'll bold it next time. However, thank you for your analysis!

load more comments (7 replies)