Your Service Is an Unwitting Accomplice: How Confused Deputy Attacks Work
A confused deputy attack tricks a privileged service into using its authority against itself.
Your service has an API key to your cloud storage. A user sends a request. Your service dutifully writes a file. The file lands in the attacker's bucket, not…