Critical vulnerabilities in 6 AWS services disclosed at Black Hat USA

Critical vulnerabilities in six Amazon Web Services (AWS) were disclosed at Black Hat USA, potentially allowing for account takeovers, remote code execution, and data manipulation. Researchers from Aqua Security presented their findings, highlighting a "Shadow Resources" attack vector that exploited the automatic creation of S3 buckets by services like CloudFormation, Glue, EMR, SageMaker, ServiceCatalog, and CodeStar. These buckets had predictable naming conventions, enabling attackers to create their own buckets with the same names, leading to unauthorized access to sensitive information and the potential for backdoor injections. The vulnerabilities were reported to AWS in February 2024 and were resolved by June 2024. The researchers emphasized the importance of treating AWS account IDs and unique hashes as secrets to prevent such attacks. They also recommended implementing security measures to avoid using buckets owned by other accounts and following least privilege principles when assigning user roles. Although AWS has addressed these vulnerabilities, the risk of similar issues in open-source integrations remains, necessitating vigilance in securing AWS resources.

- Six AWS services were found to have critical vulnerabilities.

- The vulnerabilities allowed for account takeovers and data manipulation.

- Attackers could exploit predictable S3 bucket names to gain unauthorized access.

- AWS resolved the issues after being notified by researchers.

- Users are advised to treat account identifiers as secrets to enhance security.