edge-computing-attack

name	edge-computing-attack
description	Attacks against edge computing platforms — Cloudflare Workers (V8 isolate), Fastly Compute@Edge (WASM/Wasmtime), AWS Lambda@Edge and CloudFront Functions, Akamai EdgeWorkers, Vercel Edge Functions, and Deno Deploy. Covers V8 isolate escape, WASM sandbox bypass, request smuggling at the edge, edge KV store abuse, secret leakage via edge logs, and bypass of origin WAF via edge script injection. Distinct from cloud-security (broader CSP control plane), container-security (Linux namespaces), and web-ssrf (origin-side issues).
origin	openclaw
version	0.2.0.2
compatibility	["openclaw","claude-code","cursor","windsurf"]
allowed-tools	["Bash","Read","Write","Edit","WebSearch","WebFetch"]
metadata	{"domain":"edge-computing","tool_count":14,"guide_count":2,"mitre":"T1190-Exploit Public-Facing Application, T1552.007-Container and Cloud Instance Credentials API","last_reviewed":"2026-07-26"}

Edge Computing Attack

Supplementary Files:

• payloads.md — Attack payloads organized by edge platform: Cloudflare Workers (V8 isolate escape, KV abuse), Fastly Compute@Edge (WASM sandbox), AWS Lambda@Edge / CloudFront Functions, Akamai EdgeWorkers, Vercel Edge Functions, Deno Deploy
• test-cases.md — 18 structured test cases covering reconnaissance, edge script injection, KV/Kvstore abuse, isolate escape attempts, request smuggling, and origin WAF bypass
• guides/edge-computing-attack-playbook.md — End-to-end playbook with engagement scoping, lab setup (local Wrangler, Fastly CLI, SAM Local), attack workflows, and blue-team detection engineering
• guides/real-world-incident-case-studies.md — Eight case studies including the 2024 Cloudflare Workers KV incident, AWS Lambda@Edge CVE-2023-XX pattern, Fastly WASM breakouts, and Deno Deploy SSRF waves

Summary

This skill targets edge computing — where code runs in geographically-distributed nodes close to end users, typically in V8 isolates (Cloudflare Workers), WASM sandboxes (Fastly Compute@Edge), or restricted JavaScript engines (AWS CloudFront Functions, Lambda@Edge). The attack surface differs from origin-side attacks: edge platforms handle TLS termination, request routing, and caching, and their security model assumes a trusted-but-curious operator with strong tenant isolation.

Tools: wrangler, fastly-cli, sam-cli (SAM Local), gcloud edge, akamai-cli, vercel-cli, deno, vitesspa, chromium-headless, burp suite, postman, curl, jq

Domain: edge-computing

MITRE ATT&CK: T1190 Exploit Public-Facing Application · T1552.007 Container and Cloud Instance Credentials API · T1059 Command and Scripting Interpreter

Description

Attacks against edge computing platforms — Cloudflare Workers (V8 isolate), Fastly Compute@Edge (WASM/Wasmtime), AWS Lambda@Edge and CloudFront Functions, Akamai EdgeWorkers, Vercel Edge Functions, and Deno Deploy.

Edge platforms share common architecture: code runs in isolates (V8) or sandboxes (WASM), often co-located with hundreds of other tenants on the same physical machine. The threat model assumes:

• Operator (CSP) is trusted to enforce isolation
• Other tenants are NOT trusted (cross-tenant attacks possible)
• Origin servers may be inaccessible directly (all traffic flows through edge)
• Edge scripts have access to KV stores, secrets, and request/response bodies

This skill is distinct from:

• — which targets CSP control planes (IAM, EC2, S3) broadly