# Gaining admin access to a Siemens cloud system

DevFeed: [Gaining admin access to a Siemens cloud system](<https://devfeed.tech/articles/gaining-admin-access-to-a-siemens-cloud-system-32610.md>)

Original publisher: [Read original article](<https://eaton-works.com/2024/07/31/siemens-ama-hack/>)

Author: Eaton

Published: 2024-07-31T04:00:00Z

Content type: article

Language: en

Sources: [Eaton Works Feed](<https://devfeed.tech/sources/eaton-works-feed.md>)

Topics: [Security](<https://devfeed.tech/topics/security.md>), [Entra ID](<https://devfeed.tech/topics/entra-id.md>), [React](<https://devfeed.tech/topics/react.md>), [Angular](<https://devfeed.tech/topics/angular.md>), [JavaScript](<https://devfeed.tech/topics/javascript.md>), [web applications](<https://devfeed.tech/topics/web-applications.md>), [Single-page application (SPA)](<https://devfeed.tech/topics/spa.md>), [API](<https://devfeed.tech/topics/api.md>), [JSON Web Tokens](<https://devfeed.tech/topics/jwt.md>), [Single sign-on (SSO)](<https://devfeed.tech/topics/sso.md>)

Tags: [angular](<https://devfeed.tech/tags/angular.md>), [api](<https://devfeed.tech/tags/api.md>), [api-discovery](<https://devfeed.tech/tags/api-discovery.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [authorization](<https://devfeed.tech/tags/authorization.md>), [javascript](<https://devfeed.tech/tags/javascript.md>), [jwt](<https://devfeed.tech/tags/jwt.md>), [react](<https://devfeed.tech/tags/react.md>), [security](<https://devfeed.tech/tags/security.md>), [sso](<https://devfeed.tech/tags/sso.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>)

## AI overview

The article examines a vulnerability in Siemens AMA Cloud, a React-based cloud application. It explains how insufficient server-side authentication and reliance on client-side controls can expose APIs and allow manipulation of the application's authentication flow, including its Microsoft SSO redirect and JWT handling.

## Source excerpt

(ASPEN) Understanding the Risks of Client-Side Authentication: Why relying on client-side security isn't enough.