My Terrible Roommates: Discovering the FlowFixation Vulnerability & the Risks of Sharing a Cloud Domain

Liv Matan opens by explaining why a shared parent domain is risky in cloud environments. When many customers host subdomains under one domain, a script running on one tenant's subdomain can affect cookies that the others receive, similar to cross-site scripting on a subdomain in a web bug bounty. Cookie tossing and session fixation are the main risks discussed.

The public suffix list, a community-maintained list started by Mozilla, tells browsers which domains are shared among unrelated parties. The speaker reviewed major cloud providers and found service domains missing from it. Some gaps were fixed after reports, while one provider judged the issue not severe enough. Past cloud vulnerabilities exploited through cookie tossing were cited as cases the list could have prevented.

The central case is FlowFixation, a one-click account takeover in AWS Managed Workflows for Apache Airflow. An unauthenticated request retrieves a session identifier that becomes usable only after token-based verification, letting an attacker fix a known session into a victim's browser. An S3 bucket domain was blocked by the list, so the attacker used an API Gateway endpoint that was not, to set the cookie on the shared domain and redirect the victim to log in. AWS fixed it by refreshing the session after login. The takeaway: check whether your service domain is on the public suffix list, and treat same-site requests as untrusted if it is not.