whoAMI name confusion attacks can expose AWS accounts to malicious code execution

If the “owners” attribute is omitted when searching for an AMI, the researchers noted, AWS may return results that include public community AMIs from any account. Attackers can exploit this by publishing a malicious AMI with a matching…