HACKING AWS LAMBDA FUNCTIONS - S3 FILE UPLOAD INJECTION

Summary from the TLDR InfoSec newsletter

This post showcases the damage that a coding vulnerability in a Lambda function can cause using the DVSA intentionally vulnerable app as an example. The application includes a Lambda function that uploads files attached to the feedback form, which is vulnerable to OS command injection. This vulnerability can be used to extract the Lambda function's IAM credentials, which provide full access to Lambda and SES.