“Day 30: The Finale — The Bug That Almost Broke the Internet (Or Just My Testing Account)”
开发者在测试无服务器平台时因API调用参数错误触发系统生成1,000多个虚拟服务器,导致25,000美元云账单并被封禁。平台发现漏洞后奖励7,500美元并恢复访问。 2025-9-8 11:2:21 Author: infosecwriteups.com(查看原文) 阅读量:8 收藏

How a Simple API Call Triggered a $25,000 Cloud Bill and a Temporary Ban

Aman Sharma

Well, folks, we’ve reached Day 30. It’s been a wild ride, and I’ve saved one of my most memorable stories for last. This wasn’t just a bug; it was a digital avalanche. The target was a new “serverless” platform promising effortless auto-scaling. My goal was to test its limits. I found an API endpoint that managed background workers. A simple miscalculation with a parameter — a number that was too big — unleashed a chain reaction. Within minutes, their system had spun up over 1000 virtual servers to handle my request, triggering a massive cloud bill and automatic alerts that got my testing account instantly banned. The vendor was initially furious, but after understanding the flaw, they awarded a $7,500 bounty and reinstated my access. This is the story of the day I (accidentally) stress-tested the cloud.

free link

The Peril of “Unlimited” Scale

Cloud platforms and serverless architectures promise infinite, automatic scaling. This is powerful for developers but creates a terrifying attack vector: resource exhaustion. The question isn’t just “can I access data?” but “can I make…


文章来源: https://infosecwriteups.com/day-30-the-finale-the-bug-that-almost-broke-the-internet-or-just-my-testing-account-d63112e13427?source=rss----7b722bfd1b8d---4
如有侵权请联系:admin#unsafe.sh