🔶 AWS SageMaker Jupyter Notebook Instance Takeover

An attacker can run any code on a victim's SageMaker JupyterLab Notebook Instance across accounts. This means that an attacker can access the Notebook Instance metadata endpoint and steal the access token for the attached role.

https://blog.lightspin.io/aws-sagemaker-notebook-takeover-vulnerability

#aws