TLDR Tech / InfoSec
Microservices Attack Vectors in Modern Web Applications
Synack Red Team researcher Mustafa Bilgici walks through three real-world bug bounty findings against banking and fintech targets that exploit inter-service trust failures: an SSRF in a PDF download proxy that allowed path traversal across multiple internal extractinternal.*.corp subdomains to retrieve other users' statements (no ownership check on the document identifier), a JWT scope flaw where the e-commerce microservice in a banking super-app accepted any attacker-supplied authorization code value during token exchange because the downstream service trusted the upstream JWT without verifying its origin, and a proxytohost parameter on a GDPR consent endpoint that let external attackers pivot to live internal hosts (172.21.69.9/10/153) and pull internal intranet portal content. The recurring kill chain is implicit trust between services — internal APIs reachable through public proxies, tokens reused across boundaries without scope binding, and authorization codes accepted without subject validation. Defenders should enforce per-request authorization checks on every microservice (not just the gateway), bind tokens to user identity and audience claims with strict aud/sub validation downstream, allow-list internal proxy destinations rather than accepting host parameters from clients, and shift testing focus from the perimeter to east-west service communication paths and token exchange flows.
Read the full story