snyk.ioarticleShow, Don't Tell: What Evo Continuous Offensive Security Found in a Real Enterprise SaaS
Snyk describes a real customer engagement using its Evo Continuous Offensive Security (autonomous AI pentesting) product against a multi-tenant enterprise SaaS with hundreds of microservices behind an SPA. It details two exploitable findings: a mass assignment bug combined with broken function-level authorization (BFLA) enabling tenant-wide compromise, and a CORS origin-reflection misconfiguration, both validated as reproducible exploits.
TL;DR Snyk's AI pentesting tool found a mass-assignment/BFLA tenant takeover and a CORS reflection bug in a real multi-tenant SaaS.
Technologies named here
- Multi-tenant enterprise SaaS application
- Evo Continuous Offensive Security
- Snyk API & Web
- Evo platform
- Snyk
Techniques named here
- Mass assignment / broken function-level authorization
- Privilege escalation via authorization flaw
- CORS misconfiguration / origin reflection
- Vulnerability chaining
- Time-based 2FA/TOTP bypass via automation
- Insecure CORS policy exploitation
Related in AppSec
github.comadvisoryFlowise MCP Security Bypass Enables RCE
huntress.comwriteupInside an Oracle Database SQL Injection Attack | Huntress
github.comrepoOASIS
blog.trailofbits.comwriteup