From NXDOMAIN to 428,068 Records: RDS Sibling Enumeration at a Major Chilean Bank
Disclaimer Reported to the affected company, one of the main banks in Chile, and since mitigated. The screenshots are real captures with hostnames, credentials, addresses and personal data blurred out. Identifiers in the text are placeholders. Validation was read only. Introduction On 30 September we pulled a production MySQL password out of a 500 page on a bank’s rewards site. The host it named didn’t resolve, so the credential looked dead on arrival. It wasn’t. The part of an RDS hostname shared by every instance in the same account and Region led us to a sibling: same password, still working, full admin over 428,068 identity records. ...