Security vulnerabilities rarely exist in isolation. Even seemingly minor flaws can become stepping stones for sophisticated attackers to orchestrate significant breaches. Here are five real-world examples uncovered by Intruder’s security team that demonstrate this escalation pattern.

## 1. AWS Credential Theft via Redirect SSRF

During an assessment of a home-moving application hosted on AWS, security researchers exploited a Server-Side Request Forgery (SSRF) vulnerability. The attack chain was straightforward but devastating:

– The application sent webhook requests to external URLs
– Researchers set up a server that responded with a 302 redirect to AWS’s metadata service
– The application followed the redirect and logged the response, exposing AWS credentials

With these credentials, attackers could potentially access and manipulate cloud resources. This breach could have been prevented by enforcing AWS IMDSv2, a security best practice that restricts metadata access.

## 2. Exposed Git Repository Leads to Database Compromise

What began as a simple misconfiguration—an exposed .git repository—quickly escalated into a serious breach:

– Researchers discovered the repository belonged to a public web application
– Source code review revealed an authentication bypass using a hidden parameter
– After gaining access, they identified a blind SQL injection vulnerability
– This vulnerability allowed access to a university database containing sensitive student and staff information

This chain reaction demonstrates how a seemingly minor oversight can lead to significant data exposure.

## 3. ExifTool Metadata Reveals Path to Remote Code Execution

While examining a document signing application, researchers noticed “ExifTool” listed in PDF metadata. This small detail led to a critical discovery:

– Testing confirmed the application used a version vulnerable to CVE-2021-22204
– By uploading a specially crafted PDF, researchers achieved remote command execution
– This initial access could enable privilege escalation and lateral movement across the network

The vulnerability highlights how outdated components can create serious security risks even in otherwise secure applications.

## 4. Self-XSS Combined with Cache Poisoning

Cross-site scripting vulnerabilities become particularly dangerous when chained with other flaws:

– Researchers found a Self-XSS vulnerability where user-supplied HTTP headers were reflected in responses
– Normally harmless, this vulnerability became critical when combined with a cache-poisoning weakness
– The combination allowed researchers to trick the application into caching and serving malicious code to all visitors
– This escalation enabled potential account takeover of any user, including administrators

## 5. Simple API Weaknesses Exposing Sensitive Data

Some of the most damaging vulnerabilities require minimal technical skill to exploit:

– Insecure Direct Object References (IDOR) in APIs often need only a simple parameter change
– Examples included endpoints that allowed accessing other users’ profiles, job applicants’ resumes, and customer orders
– By incrementing ID numbers, attackers could potentially extract entire databases of sensitive information

These real-world examples demonstrate how attackers can leverage seemingly minor vulnerabilities to orchestrate major security breaches. Continuous discovery and scanning of internet-facing assets—including unknown ones—is essential for preventing such attacks before they occur.