CYPHERLOCK, INC.

Exploiting AWS Weaknesses: How Hackers Can Seize Complete Remote Control

Aqua researchers have uncovered critical security flaws in several Amazon Web Services (AWS): CloudFormation, Glue, EMR, SageMaker, ServiceCatalog, and CodeStar.

These flaws, ranging from remote code execution to full-service user takeovers and denial of service (DoS) attacks, posed significant risks to global AWS users. The research highlighted two primary attack methods: “Shadow Resource” and “Bucket Monopoly.”

These methods target AWS resources that are automatically generated, such as S3 buckets, often without user awareness. By exploiting these techniques, attackers could execute malicious code, exfiltrate data, or gain unauthorized access to user accounts.

Discovery and Response Timeline:

  • February 16, 2024: Vulnerabilities in CloudFormation, Glue, EMR, SageMaker, and CodeStar were reported to AWS.
  • February 18, 2024: A vulnerability in ServiceCatalog was reported.
  • March 16-25, 2024: AWS confirmed fixes for issues in CloudFormation, EMR, Glue, and SageMaker.
  • April 30, 2024: It was reported that the CloudFormation fix still left users vulnerable to DoS attacks.
  • May 7, 2024: AWS announced ongoing work to address the CloudFormation DoS issue.
  • June 26, 2024: AWS confirmed that fixes for ServiceCatalog and CloudFormation issues were in place.
  • August 2024: The findings were presented at Black Hat USA and DEF CON 32.

Technical Insights:

AWS services can automatically generate resources like S3 buckets, often using predictable naming schemes. For example, CloudFormation generates S3 buckets with a standard naming convention, which can be exploited if attackers preemptively create buckets with the same names.

Service-Specific Vulnerabilities:

  • CloudFormation: Attackers could exploit predictable S3 bucket names to execute code, manipulate data, or gain full access to user accounts.
  • Glue: Vulnerabilities allow code injection into Glue jobs, potentially leading to remote code execution (RCE) and account compromise.
  • EMR, SageMaker, ServiceCatalog: Specific details not provided, but these services were also affected.
  • CodeStar: The issue is addressed as the service is set for deprecation in July 2024, with new projects no longer being allowed.

Exploitation Technique:

Attackers could leverage predictable S3 bucket names to intercept or manipulate data. By claiming buckets in unutilized regions, attackers increase the chance of intercepting user data or compromising accounts.

Mitigation Strategies:

  1. Scoped Policies: Implement aws:ResourceAccount conditions in policies to restrict access to trusted accounts only.
  2. Bucket Ownership Verification: Regularly verify S3 bucket ownership to ensure they are under your control.
  3. Unique Bucket Naming: Use unique identifiers or random sequences for bucket names to avoid predictability.

While AWS has addressed the vulnerabilities in these services, similar risks may exist in other AWS services or open-source projects. Organizations should adhere to security best practices and apply recommended mitigations to safeguard against potential threats.

More Articles & Posts

Scopes

2025 Active Exploitation AI Alert Analysis Attack Attackers Attacks Breach Breaches Campaigns China chrome CISA Cisco CISO CISOs credentials Critical Critical Flaw Critical Vulnerability CrowdStrike Cutting-Edge Cyber Attack Cyberattack cyberattacks Cybercriminals cybersecurity Cybersecurity Initiatives Cybersecurity Solutions Cyber Threats DDoS Attacks Discovered Enables Exploit Exploited Exploiting Exploits Exposes FBI Flaw Generative AI google Guide Hackers Hackers Exploit Healthcare Hijack Hit Insights Invest Ivanti Linux macOS malicious malware Massive data Breach MFA microsoft Microsoft 365 Microsoft Azure NIST Patch Phishing Phishing Attack PoC Privilege Escalation Ransomware Ransomware Attack ransomware attacks RCE RCE Vulnerability Released Remote Code Execution Researchers risk Scam security Security Flaw Strategies Strategy Systems Target Targeted Targeting Targets Threat Actors Threat Intelligence threats UK Unauthorized Code Execution Under Attack Users vulnerabilities Vulnerability WhatsApp windows Windows 11 Windows Systems Zero-Day