Summary
An adversary could gain access to IAM credentials in a victim's account, and make an API request to Elastic Beanstalk (even if they didn't have the proper IAM permissions). This request would be displayed in the management console in the Elastic Beanstalk section. Due to improper sanitization, an attacker could insert an XSS payload that would execute in a victim's browser.
Affected Services
AWS Management Console
Remediation
None required
Tracked CVEs
No tracked CVEs
References
https://twitter.com/Frichette_n/status/1400517723910819844https://frichetten.com/blog/xss_in_aws_console/
Contributed by https://github.com/0xdabbad00
Entry Status
Finalized
Disclosure Date
Sat, Mar 13th, 2021
Exploitablity Period
March 2021 - June 2021
Known ITW Exploitation
-
Detection Methods
-
Piercing Index Rating
-
Discovered by
Nick Frichette
