A logical flaw in S3 bucket-naming conventions could have allowed hackers to lay booby traps for organizations creating new buckets
Critical vulnerabilities in six Amazon Web Services have been disclosed by researchers from a cybersecurity firm.
The vulnerabilities were found in the following AWS services: CloudFormation, Glue, EMR, SageMaker, ServiceCatalog and CodeStar.
When any of these services are used in a new region for the first time, an S3 bucket is automatically created with a certain name. This name is divided into the name of the service of the AWS account ID (in most services mentioned above) and the name of the region. Thereby, across all AWS regions, the bucket name remains the same, differing only by the region name.
Researchers from Aqua Security have uncovered how attackers could discover the buckets’ names or guess predictable parts of the bucket name. Subsequently, using a method dubbed “Bucket Monopoly” the attackers can create buckets with these names in advance in all available regions (essentially performing a virtual landgrab), then store malicious code in the bucket. As S3 bucket names are unique across the provider’s platform, if a bucket has been “captured”, no one else can claim that bucket name thereafter.
The potential impacts include remote code execution and full-service user takeover, which could provide cybercriminals with the means to gain administrative access, manipulate AI modules; exfiltrate sensitive data, and launch denial-of-service attacks.
The firm had promptly disclosed its findings to the AWS security team, who had quickly acknowledged and fixed all the vulnerabilities.
According to the firm’s lead researcher, Yakir Kadkoda: “When the targeted organization enables the service in a new region for the first time, the malicious code will be unknowingly executed, potentially resulting in the creation of an admin user in the targeted organization — granting control to the attackers.”
The firm has demonstrated how S3 can become a “shadow resource”, and how attackers can discover or guess bucket names and exploit them if the aforementioned critical vulnerability is not addressed.
