This technical case study, titled Cloud Sandbox Security Analysis, delves into the vulnerabilities associated with environment variable exfiltration within an algorithmic trading competition platform. The research highlights a significant deficiency in sandbox isolation, which facilitates unauthorized access to and extraction of sensitive cloud credentials, particularly AWS Access Keys, through standard output streams.

Key Findings

• Vulnerability: The analysis reveals insufficient process isolation within the execution sandbox, exposing critical infrastructure.
• Exfiltration Vector: Attackers can gain direct access to environment variables and transmit them via stdout.
• Risk Level: Classified as critical due to the potential for full disclosure of infrastructure secrets.

Current Status

This repository includes comprehensive research documentation and a Proof of Concept (PoC) aimed at providing insight into the identified vulnerabilities. It represents a commitment to responsible disclosure, as the vendor has been notified of these findings prior to publication.