Collected research

All Your Clouds Are Belong to Us: Security Analysis of Cloud Management Interfaces

Juraj Somorovsky, Mario Heiderich, Meiko Jensen, Jörg Schwenk, Nils Gruschka and Luigi Lo Iacono · nds.rub.de

Researchers attacked the cloud control interfaces of Amazon EC2/S3 and Eucalyptus. Four XML Signature wrapping variants let a single eavesdropped SOAP request trigger arbitrary operations, and a signature-exclusion bug authorised requests carrying only a public X.509 certificate. Persistent XSS in the Amazon shop reached the AWS console through shared login sessions.

Record

Researcher

Juraj Somorovsky, Mario Heiderich, Meiko Jensen, Jörg Schwenk, Nils Gruschka and Luigi Lo Iacono

Published by

nds.rub.de

Format

Whitepaper

Topic

Server

In the archive

• Collected in the 2011 research round

Tags

• aws
• soap
• parser-differential
• auth-bypass
• xss
• sso
• case-study
• owasp-a01-2021
• owasp-a03-2021
• owasp-a07-2021

This page is the archive's own catalogue record. The research is the work of Juraj Somorovsky, Mario Heiderich, Meiko Jensen, Jörg Schwenk, Nils Gruschka and Luigi Lo Iacono, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 14 August 2026.