Aug 2026· International Journal of Information Security· Vol 25· 0 citations· 50 references
TL;DR
This study conducts a large-scale empirical security analysis of the web-based management interfaces of ten widely used open-source Infrastructure-as-a-Service (IaaS) platforms, identifying 16 vulnerabilities spanning nine classes, including high-severity flaws that enable account takeover.
Abstract
The security of open-source cloud platforms is paramount, given their widespread adoption in modern business operations. This study conducts a large-scale empirical security analysis of the web-based management interfaces of ten widely used open-source Infrastructure-as-a-Service (IaaS) platforms. Using a black-box penetration testing methodology that combines automated scanning with Burp Suite and its security extensions with systematic manual analysis, we identified a total of 16 vulnerabilities spanning nine classes, including high-severity flaws that enable account takeover. Our findings, which culminated in the assignment of six new Common Vulnerabilities and Exposures (CVE) IDs, provide concrete, empirically validated examples of how server misconfigurations and flawed authentication logic manifest in the exposed management interfaces of mainstream open-source IaaS platforms, including mis-issued API tokens, time-based user enumeration, and host-header–driven misrouting. Specifically, the identified vulnerabilities stem from improper authentication, insufficient input validation, and server misconfigurations. In addition to a responsible vulnerability disclosure process, this work provides practical hardening recommendations to mitigate the identified weaknesses.
This study examines the evolving security landscape of serverless computing, specifically focusing on AWS Lambda and Google Cloud Functions. While serverless architectures offer significant scalability and cost advantages, their event-driven nature introduces unique vulnerabilities that traditional infrastructure-based security measures often fail to address. To identify these risks, a multi-methodological approach was employed, involving systematic literature mapping, platform benchmarking, and threat modeling using the STRIDE framework. The research specifically analyzed the "blast radius" of compromised functions and the efficacy of current penetration testing methodologies. Results indicate that Identity and Access Management (IAM) misconfigurations are the primary driver of cloud breaches, accounting for 42% of critical vulnerabilities, while traditional network scanning yielded zero actionable detection data. Furthermore, simulation data revealed that unthrottled "Denial-of-Wallet" attacks can cause catastrophic financial loss within minutes. Based on these findings, a five-layer defense-in-depth framework is proposed, integrating secure secret management, automated dependency scanning, and identity-centric governance. The study concludes that securing serverless environments requires a paradigm shift from network-level protection to granular application logic validation and continuous observability. These measures are essential for maintaining data integrity in decentralized cloud-native environments.
Norsyazwani Mohd Puad, Paiwand Hadi Hama Saeed, Braw Araz Mohammed et al.· Journal of Applied Computer...· 0 citations
Enterprise database systems are frequently targeted due to their reliance on perimeter-based, static access control models that lack continuous verification and privilege minimization. This study designed and empirically validated a three-layer Zero Trust architecture for Microsoft SQL Server that natively integrates instance-level authentication governance, enhanced Role-Based Access Control (RBAC) with Row-Level Security (RLS) and Just-in-Time (JIT) privilege elevation, and metadata-driven Attribute-Based Access Control (ABAC) through data classification — all without requiring external security middleware. Employing design science and applied experimental methodology, architecture was deployed in a live production environment comprising 589 databases and 132 identities over a 90-day post-implementation period. Chi-square tests of independence with Cramér's V effect size confirmed statistically significant reductions: login misuse declined by 82.1%, malicious authentication attempts by 66.7%, deployment errors by 59.8%, and reporting disruptions by 43.7%. Overprivileged accounts decreased by 84.2%. These results demonstrate that a coordinated, database native Zero Trust pipeline substantially reduces attack surfaces and insider risk in enterprise SQL Server environments. The proposed architecture aligns with globally recognized compliance frameworks, including ISO/IEC 27001 and GDPR, offering a replicable and regulatory-ready deployment model for enterprise environments across diverse jurisdictions.
Maynard Capil, D. Dasig· JPAIR Multidisciplinary Rese...· 0 citations
Remote-access virtual private networks (VPNs) are a key component of enterprise security infrastructures. In practice, the effectiveness of a remote-access VPN is determined not only by cryptographic mechanisms but also by its ability to remain available and recover quickly under realistic operating conditions, which directly affects the operational security guarantees provided by the underlying cryptographic protocols. Enterprise deployments are characterized by heterogeneous client platforms, wireless access networks, and frequent endpoint and network disruptions. In this paper, we execute an exploratory case study of the operation of remote-access VPNs in enterprise environments through an empirical evaluation of WireGuard, OpenVPN, and IPsec. Using a controlled but realistic testbed with a cloud-hosted gateway and heterogeneous client platforms, we evaluate baseline performance as well as behavior under endpoint CPU stress, network impairments, MTU variation, and mobility-related disruptions, reflecting constrained and dynamically changing deployment conditions. The results suggest that VPN operational characteristics are influenced by both protocol design and execution environment. Within the evaluated deployment scenarios, kernel-based implementations generally exhibited higher resilience under endpoint resource contention and faster recovery after disruptions, while layered and virtualized environments exhibited increased variability and sensitivity to network imperfections. These findings underline that resilience in remote-access VPNs should be interpreted as a system-level property emerging from the interaction of implementation architecture, endpoint characteristics, and deployment conditions.
Rene Forsung, R. Pirmagomedov, A. Mezina et al.· Cryptography· 0 citations
It is concluded that web application security requires continuous assessment and proactive security practices throughout the software development lifecycle, and adopting OWASP guidelines and implementing effective security controls can significantly enhance the protection and resilience of modern web applications.
S. Banu, H. Shanmatha, Mehdi Gheisari et al.· BOHR International Journal o...· 0 citations
The Model Context Protocol (MCP) has seen rapid adoption since its November 2024 launch, with over 21,000 server instances detectable on the public internet. We present the first dynamic behavioral security assessment of internet-facing MCP servers, combining passive discovery across eleven data sources (crt.sh, HuggingFace, GitHub, npm, Smithery, PyPI, Censys, FOFA, Shodan, glama.ai, and pulsemcp.com) with active dynamic testing using Corvus, a purpose-built framework implementing 34 test modules covering 10 MCP-specific vulnerability classes. Across four measurement runs spanning July 2026, we confirm 640 production MCP servers and dynamically audit 414, uncovering 68 reportable vulnerabilities including SQL injection, SSRF targeting cloud metadata services, prompt template injection, and path traversal via cursor manipulation. We find that 91.8% of dynamically audited servers lack OAuth authentication, 687 tool instances across confirmed servers expose shell execution capabilities without access controls, and 41.6% of confirmed servers disappear within three days between consecutive measurement runs---indicating rapid deployment cycles without security review. We report on our responsible disclosure pipeline and release Corvus as an open-source framework for MCP security evaluation.
HawkEye is introduced, a modular, web-based vulnerability auditing platform designed to streamline security analysis by integrating multiple scanning tools within a unified dashboard and illustrates how consolidated reporting improves vulnerability prioritization for development teams.
D. R. Patil, Varad Salgare, Devaj Arya et al.· International Journal for Re...· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
