From ‘huh?’ to privilege escalation

Security research is not something that’s only done by dedicated teams and companies. Sometimes it will be a developer or platform engineer that makes the jump from “that’s not how I expect it to work” to “that’s not how it’s supposed to work”.

In this talk we’ll walk through the process we took when we found strange behaviour in the AWS console, tried to debug what’s going wrong and ended up finding an API that didn’t check iam:PassRole correctly. We’ll see that in a lot of cases the needs of a person who’s debugging and a security researcher will overlap and that features like CloudTrail and documented APIs are useful resources for everyone.

Presentation given at fwd:cloudsec 2023 (https://fwdcloudsec.org/)

Transcript

1. From ‘huh?’ to privilege escalation Finding vulnerabilities from a bug in the AWS console Ben Bridts
2. who are we building for?
3. Huh?
4. AWS Well- Architected Reviews AWS Professional Services AWS Architecture Design AWS 24/7 Managed Services AWS DevOps Best Practices AWS Migration Expertise & Guidance AWS Public Sector Solutions AWS Workshops & Training AWS Reselling & Cost Optimization
5. AWS Directory Service AWS Directory Service Simple AD AD Connector AWS Managed Microsoft AD Amazon WorkSpaces Amazon WorkDocs Amazon QuickSight Amazon Chime Amazon Connect Amazon Relational Database Service (Amazon RDS) Amazon Elastic Compute Cloud (Amazon EC2) AWS Management Console
6. AWS Directory Services Console
9. Investigation
11. https://docs.aws.amazon.com/directoryservice/latest/admin-guide/UsingWithDS_IAM_ResourcePermissions.html
12. Lessons CloudTrail is not a given, especially for console-only actions CloudTrail is extremly valuable for operations and defense
13. who are we building for?
14. Reproducing the issue
17. https://botocore.amazonaws.com/v1/documentation/api/latest/reference/loaders.html
19. Takeaways Race conditions will happen Nonpublic can still be usable (especially for attackers) client-side is untrusted
20. who are we building for?
21. Privilege escalation
22. Existing Directory User Role ds-group-a User Role ds-group-b Alice Bob Group A Group B
23. Existing Directory User Role ds-group-a User Role ds-group-b Alice Bob Group A Group B Permissions Permissions Trust Relationship Trust Relationship
24. Existing Directory User Role ds-group-a User Role ds-group-b Alice Bob Group A Group B Permissions Permissions Trust Relationship Trust Relationship
25. Existing Directory User Role ds-group-a User Role ds-group-b Alice Bob Group A Group B Permissions Permissions https://docs.aws.amazon.com/directoryservice/latest/admin-guide/create_role.html [docs]/directoryservice/latest/admin-guide/UsingWithDS_IAM_ResourcePermissions.html
26. Existing Directory User Role ds-group-a User Role ds-group-b Alice Bob Group A Group B Permissions Permissions https://docs.aws.amazon.com/directoryservice/latest/admin-guide/create_role.html Group C
27. Existing Directory User Role ds-group-a Alice Bob Group A Permissions Permissions https://docs.aws.amazon.com/directoryservice/latest/admin-guide/create_role.html Group C New Directory
28. Takeaways Nonpublic APIs makes IAM Policies harder to write Make ExternalIds as specific as possible Verify the negative too
29. who are we building for?
30. Conclusion
31. we can’t claim shared responsibility without the right tools
32. there is still low-hanging fruit
33. who are we building for?
34. Please make me happy too Add auditing to your products Create documented, public APIs Use more specific ExternalIds
35. https://fwdcloudsec.org/speakers.html#evading-logging-cloud-aws https://fwdcloudsec.org/speakers.html#ground-shifts-underneath-us https://github.com/benbridts/aws-undocumented-api-models https://github.com/Frichetten/aws-api-models https://www.youtube.com/watch?v=R039RTcy6_w Learn more https://cloudar.be/awsblog/cloudsec2023
36. Thank you! Ben Bridts ben@cloudar.be @BenBridts | @WeAreCloudar www.cloudar.be