Wiz Details Three AWS Cross-Account Vulnerabilities and Their Root Cause
Summary
Wiz reported three AWS cross-account vulnerabilities that could let attackers read or write to other customers’ accounts. AWS fixed its policies, but Wiz’s sample found many customer environments remained vulnerable because users needed to update their own policies.
Key points
- Wiz says it found three vulnerabilities in CloudTrail, AWS Config, and Serverless Repository that could enable cross-account access.
- The CloudTrail and AWS Config issues could let an attacker write service logs into another customer’s bucket.
- Wiz says the Serverless Repository issue could let attackers read private S3 bucket objects, potentially including source code, passwords, and other artifacts.
- The reported root cause was permissive resource policies that trusted AWS services without sufficiently restricting who could use them to access customer resources.
- Wiz reported the issues to AWS in November 2020; AWS added policy conditions, but one issue also required customers to update existing policies.
- In Wiz’s sample, more than 90% of Serverless Repository buckets and over 25% of environments using the CloudTrail policy remained vulnerable; Wiz cautioned that the sample might not represent AWS customers overall.
Article Details
- Attack Vectors
- Misconfigured cross-account resource policies allowed CloudTrail and AWS Config to write service logs into customer accounts when an attacker configured the services to target a customer bucket.
- The Serverless Repository could be manipulated to read objects from other customers’ private S3 buckets, including in isolated accounts not connected to the internet.
- The vulnerabilities involved AWS services performing actions on an attacker’s behalf where the target resource trusted the service without conditions. The article describes vulnerabilities and potential exploitation, not confirmed attacks.
- Defensive Notes
- Update affected resource policies to add conditions that restrict which accounts or users can use the AWS services to access resources.
- Review Serverless Repository bucket policies and CloudTrail policies for the reported misconfigurations; the article reports that more than 90% of surveyed Serverless Repository buckets and more than 25% of surveyed environments’ CloudTrail policies remained vulnerable.
- AWS planned to add the vulnerabilities to AWS Access Analyzer to notify users about misconfigured service access.
Vendors
AmazonThat feedback loop was critical to our research on a new class of “cross-account” vulnerabilities in Amazon Web Services (AWS). Customers use AWS (and other cloud providers) with the expectation that their cloudWizOver the past year, Wiz’s research team has discovered a range of new attack surfaces in the cloud.
Products
AWSHow isolated are AWS accounts?AWS Access Analyzerpolicies to prevent unauthorized access. AWS also plans to add these vulnerabilities to the AWS Access analyzer so all users can get out-of-the-box notifications for misconfigured service access.AWS ConfigSo we were surprised to discover that in some cases, AWS services (CloudTrail, AWS Config and Serverless Repository) could be manipulated to give anyone access to the specific resources of other customers.AWS Serverless Repository ServiceSo we were surprised to discover that in some cases, AWS services (CloudTrail, AWS Config and Serverless Repository) could be manipulated to give anyone access to the specific resources of other customers.CloudTrailAs an example, the popular CloudTrail service allows customers to collect logs from multiple accounts and centralize them in one bucket.Personal Health DashboardIn this case, Amazon sent alerts like the one below to vulnerable users via email and security notification in Amazon's Personal Health Dashboard.S3Most of us wouldn’t think twice before giving AWS CloudTrail access to our S3 buckets and other cloud resources.