Exposed Vulnerable Training Apps Lead to Active Cloud Attacks

Recent findings from Pentera indicate a troubling trend where vulnerable training applications are being left exposed on the public internet. The research focused on well-known intentionally vulnerable apps, including OWASP Juice Shop and Damn Vulnerable Web Application, which are commonly used for secure coding education and internal testing. The study identified 1,926 live and vulnerable applications, primarily hosted on major cloud platforms such as AWS, Google Cloud, and Azure.

These applications were often running in default or misconfigured states, allowing attackers to exploit them easily. Once compromised, attackers could execute remote code and access cloud metadata services to extract sensitive identity information and temporary credentials. In 109 instances, exposed credentials were linked to unique cloud identities with broad permissions, enabling access to critical resources.

The report also highlights evidence of active exploitation, with around 20 percent of discovered DVWA instances showing signs of malicious activity. Attackers commonly deployed XMRig cryptocurrency miners to exploit these vulnerabilities, alongside persistence mechanisms designed to maintain access even after cleanup attempts.

Several case studies within the report reveal that large technology and security vendors have also fallen victim to these exposures. For example, a bWAPP deployment linked to a Google Cloud account allowed unauthorized access to storage buckets. Each case was responsibly disclosed and remediated before the report’s publication.

The research underscores the need for better asset tracking and monitoring in training environments, which often lack the same security measures as production systems. Default credentials and permissive access settings were frequently found, increasing the risk of exploitation.

Practical Recommendations for Organizations

To mitigate these risks, organizations should maintain an accurate inventory of all cloud assets and apply strict least-privilege permissions to non-production environments. Additionally, changing default credentials before deployment and routinely scanning for exposed services can help protect against potential attacks.

• OWASP Juice Shop: A vulnerable web application used for teaching secure coding practices.
• Damn Vulnerable Web Application: Another intentionally vulnerable app that serves as a training tool for security professionals.
• Hackazon: A vulnerable application designed to simulate a real-world e-commerce site for security testing.