Summary
Resource policies lacked a way of restricting service access to only your
own account, allowing an attacker to leverage a service to potentially access
your resources. Originally discovered by Dan Peebles and presented at re:Invent
in 2018, this issue did not gain enough attention to be fixed until Shir Tamari
and Ami Luttwak from Wiz presented it at Black Hat 2021.
Affected Services
N/A
Remediation
Update existing vulnerable IAM policies by adding scoping condition.
Tracked CVEs
No tracked CVEs
References
https://www.youtube.com/watch?v=F3JmBhTQmyY&t=2475shttps://summitroute.com/blog/2019/04/03/advanced_aws_policy_auditing_confused_deputies_with_aws_services/https://www.wiz.io/blog/black-hat-2021-aws-cross-account-vulnerabilities-how-isolated-is-your-cloud-environment
Contributed by https://github.com/a10ns
Entry Status
Finalized
Disclosure Date
Wed, Nov 28th, 2018
Exploitablity Period
until February 2021
Known ITW Exploitation
-
Detection Methods
-
Piercing Index Rating
-
Discovered by
Dan Peebles, Bridgewater
