Innovative, Shiny, and Vulnerable: Four Ways to Exploit Modern SaaS Data Platforms

The talk looks at SaaS data platforms that ingest large volumes of customer and proprietary data and hold privileged credentials for third-party systems. Because these products are publicly exposed and tightly tied to business processes, weaknesses in them create supply chain and third-party risk. The speaker uses a demonstration platform to walk through the attack paths.

The first avenue is control plane access control, where broken object-level authorization lets users reach other workspaces or tenants, and predictable identifiers make enumeration easy. The second is abusing the platform's job feature, which runs user-supplied scripts. Command execution on the runner exposed the container's startup configuration, including an overprivileged service account key that could read secrets for other organizations. Instance metadata then yielded a cloud role able to list a storage bucket of execution logs containing personal data.

The fourth vector is serverless abuse: a single request set up an infinite loop through a streaming API and a Lambda function, pushing over ten million events in about two minutes and exhausting a free tier. Attackers could drive costs, cause denial of service against third parties, or trigger provider intervention. The takeaways are to test authorization on every endpoint, keep runner secrets scoped to the job, restrict cloud roles to the tenant, and threat model cost abuse in serverless designs.