Critical AWS Vulnerabilities Allow Attackers to Perform Remote Code Execution

Researchers identified a new attack vector, “Shadow Resources,” enabling resource squatting through predictable S3 bucket naming conventions.

By leveraging “Bucket Monopoly,” an attacker can significantly increase the likelihood of compromising accounts, which led to the discovery of critical vulnerabilities in six AWS services, allowing for remote code execution, full-service takeover, data exfiltration, and denial of service. 

AWS has since addressed these issues, but similar risks may persist in other services or environments. AWS CloudFormation automatically creates S3 buckets to store templates, without explicit user knowledge, which are named with a predictable format: “cf-templates-randomhash-region.” 

While the random hash component is difficult to guess, attackers could create similarly named buckets in unused regions, potentially intercepting template uploads and gaining unauthorized access to victim accounts through subsequent CloudFormation operations. 

An attacker can exploit the predictable naming convention of CloudFormation template buckets (cf-templates-{Hash}-{Region}) to perform a Denial of Service (DoS) attack. 

By preemptively creating a bucket with a target account’s hash in a specific region, an attacker can prevent the victim from uploading CloudFormation templates because CloudFormation attempts to reuse existing buckets, leading to access denied errors when interacting with the attacker’s bucket. 

While the default S3 bucket policy mitigates this issue by blocking public access, it does not prevent CloudFormation from attempting to access the attacker’s bucket. 

An attacker can also escalate a DoS attack on a predictable S3 bucket to a critical impact by making the bucket publicly accessible and creating a permissive policy, which allows CloudFormation to write template files to the attacker’s bucket. 

By leveraging a TOCTOU vulnerability in CloudFormation, the attacker can inject malicious resources, including an admin role, into the template before deployment, which grants the attacker full control over the victim’s AWS account, provided the original CloudFormation user had sufficient permissions. 

Research uncovered predictable S3 bucket naming patterns for several AWS services, including Glue, beyond the previously known CloudFormation hash vulnerability. 

By exploiting these patterns, attackers can create buckets with identical names in target accounts, intercept data, and potentially execute malicious code. 

For instance, Glue’s predictable bucket format, “aws-glue-assets-{Account-ID}-{Region}”, allows an attacker to create a bucket, inject code into Glue jobs, and achieve remote code execution, bypassing detection mechanisms in the AWS Management Console.

Researchers at Aqua identified a critical vulnerability in multiple AWS services (EMR, SageMaker, CodeStar, and Service Catalog) that leverage predictable S3 bucket naming conventions (e.g., aws-emr-studio-{Account-ID}-{Region}) to perform a “Shadow Resource” attack. 

Attackers can pre-create buckets with these names and exploit services that write to them, which could lead to XSS, data exfiltration, or even account takeover, depending on IAM role permissions. 

AWS patched the vulnerabilities in most services (EMR, SageMaker, and Service Catalog) by adding randomness to bucket names or prompting users for a new name if a bucket already exists. CodeStar is being deprecated to address the vulnerability. 

Also Read:

Head Mar Hacker Group Exploit CVE-2023-38831 Vulnerability in WinRAR

See more