{"id":15523,"date":"2026-01-21T22:34:36","date_gmt":"2026-01-21T22:34:36","guid":{"rendered":"https:\/\/newestek.com\/?p=15523"},"modified":"2026-01-21T22:34:36","modified_gmt":"2026-01-21T22:34:36","slug":"misconfigured-demo-environments-are-turning-into-cloud-backdoors-to-the-enterprise","status":"publish","type":"post","link":"https:\/\/newestek.com\/?p=15523","title":{"rendered":"Misconfigured demo environments are turning into cloud backdoors to the enterprise"},"content":{"rendered":"
\n
\n
\n
\n
\n
\n
<\/div>\n<\/section>\n

Internal testing, product demonstrations, and security training are critical practices in cybersecurity, giving defenders and everyday users the tools and wherewithal to prevent and respond to enterprise threats.<\/p>\n

However, according to new research from Pentera Labs, when left in default or misconfigured states, these \u201ctest\u201d and \u201cdemo\u201d environments are yet another entry point for attackers \u2014 and the issue even affects leading security companies and Fortune 500 companies that should know better.<\/p>\n

Researchers discovered that popular public training apps like Hackazon, Damn Vulnerable Web Application (DVWA), and OWASP Juice Shop have been frequently left accessible to the public internet, inadvertently exposing top vendors including Palo Alto Networks, Cloudflare, and F5.<\/p>\n

\u201cThis is not theoretical research,\u201d Noam Yaffe<\/a>, Pentera\u2019s senior researcher and offensive security team lead, wrote in a technical blog post<\/a>. His team discovered \u201cclear evidence\u201d that these attack vectors are being exploited in the wild to enable crypto miners, webshells, and persistence mechanisms. The attackers are believed to be of Eastern European origin.<\/p>\n

\u201cThis research proves that labeling something as \u2018training\u2019 or \u2018dev\u2019 doesn\u2019t make it invisible to attackers,\u201d Yaffe noted. \u201cIf it\u2019s on the internet and it has cloud credentials, it\u2019s a target.\u201d<\/p>\n

Exposing crown jewels through seemingly harmless labs<\/h2>\n

After identifying an exposed instance of Hackazon, a free, intentionally vulnerable test site developed by Deloitte, during a routine cloud security assessment<\/a> for a client, Yaffe performed a five-step hunt for exposed apps. His team uncovered 1,926 \u201cverified, live, and vulnerable applications,\u201d more than half of which were running on enterprise-owned infrastructure on AWS, Azure, and Google Cloud platforms.<\/p>\n

They then discovered 109 exposed credential sets, many accessible via a low-priority lab environment, tied to overly-privileged identity access management (IAM)<\/a> roles. These often granted \u201cfar more access\u201d than a \u2018training\u2019 app should, Yaffe explained, and provided attackers:<\/p>\n