writeups.xyz / No keys attached: Exploring GitHub-to-AWS keyless authentication flaws

Submitter : c2a

Date: 27 July 2023

Bounty : undisclosed

Vulnerabilities :

• OIDC
• CI/CD
• Cloud
• Account Takeover

Programs :

• UK Cabinet Office

Authors :

• Christophe Tafani-Dereeper (@Christophetd)

Link :
https://securitylabs.datadoghq.com/articles/exploring-github-to-aws-keyless-authentication-flaws/