low

Lack of internal change controls for IAM managed policies

Published Thu, Oct 15th, 2020
Platforms

Summary

AWS have released or changed managed IAM policies in unexpected and insecure ways. Examples include: CheesepuffsServiceRolePolicy, AWSServiceRoleForThorInternalDevPolicy, AWSCodeArtifactReadOnlyAccess.json, AmazonCirrusGammaRoleForInstaller. The worst being the ReadOnlyAccess policy having almost all privileges removed and unexpected ones added.

Affected Services

N/A

Remediation

None required

Tracked CVEs

No tracked CVEs

References

Contributed by https://github.com/Rami_McCarthy
Entry Status
Finalized
Disclosure Date
Thu, Oct 15th, 2020
Exploitablity Period
-
Known ITW Exploitation
-
Detection Methods
-
Piercing Index Rating
-
Discovered by
-

More vulnerabilities...

low

Multiple issues in AWS IAM Authenticator for Kubernetes

Amazon Elastic Kubernetes Service (EKS) uses IAM to provide authentication to the cluster through the AWS IAM Authenticator for Kubernetes (aws-iam-authenticator). Multiple issues were identified i...

...
Felix Wilhelm, Google

low

S3 bucket tagging not restricted

Lack of the privilege s3:PutBucketTagging did not restrict the ability to tag S3 buckets.

...
Ian Mckay

low

Encryption SDK vulnerabilities

AWS KMS and all versions of AWS Encryption SDKs prior to version 2.0.0 were susceptible to information leakage (an attacker could create ciphertexts that would leak the user’s AWS account ID, encry...

...
Thai Duong (thaidn), Google

View all