пятница, 8 августа 2014 г.

SSRF vs AWS Security

Hello everyone...

Just want to mention one attack-vector that is useful against AWS EC2 instances in some configurations. It is not rocket-science, but pretty fun and tell us about AWS Cloud security things and maybe can help us to do hardening. Actually I am talking about boring-sold SSRF vector. So if an attacker can do SSRF in our EC2 with SSRF what he can do?

Sometimes developers like to assign IAM Roles to instances. For example if it is deploy/build server, that needs to create new apps in AWS account or something else, doesn't matter - this just happens 8) And assigning roles to EC2 instances  - easiest way you can do it, because you do not need to think about how to deliver  Access Keys to the instance, how to rotate them and etc. Now back to SSRF...

So we have classic vulnerable App with boring XXE:


Now it's time to remember about AWS meta-data service which is available from any instance. This server return meta-data for EC2 instance that called this API:
Let's try:

Ok... so now you can get a  lot of information... but the funniest part - Temporary Access Key and Token for AWS API is also here<ROLE_NAME>...

Wow, 'apache' user got this key... and if you think that by default access with this key limited only from EC2 instance - you wrong. Please feel free to copy this key and use it from any place.



Now we can do anything that allowed by Policy/Role that assigned to hacked instance.

Let's summarize problems:

1) Anyone can get Access Key: nobody, root, apache... it's not based on OS security.
2) By default this Key works from any IP, not only from instance (but you can try to configure it in Policy at least)
3) You can't revoke this Key. You can remove Policy from the group - yes.
4) You do SSRF in your code, smart-ass!

So this is just  example how SSRF + lack of hardening on AWS account can ruin you life...

Solution for item 2, edit Policies that assigned to Role:

    "Condition": {
        "IpAddress": {
        "aws:SourceIp": "10.90.X.X"

Then you safe:

But in fact not - if box compromised or with the saem SSRF you can makes RESP API calls from the pwned isntance...

As final notes:

1) Check roles that assigned to instances. Less privileges... Better no roles...
2) If you can limit access for this policy by SRC IP -  do it, so only instances with this Role can access API.
BUT remember, if you have SSRF, than attacker can do API calls from tsame instance by same SSRF...
3) Do not code SSRF ;)

P.S. Thanks to Erian Nader from HERE Security team for helping with this material...

P.P.S. And of course, it's not about only SSRF - if instance pwned, then same risks applied. So be careful with Instance's roles!

36 комментариев:

  1. Understanding the pricing structure and available packages is essential for a budget-friendly experience visit body massage in bangalore

  2. From various massage parlour near me techniques to ambiance considerations, we'll cover it all, ensuring you make an informed choice for a serene experience.

  3. Combining acupressure body massage near me energy balance, it goes beyond the superficial, delving into the core of physical and mental well-being......

  4. Buy YouTube Subscribers" offers a rapid way for creators to increase their channel's following, enhancing their perceived popularity. It's important to ensure the purchased subscribers are genuine to comply with YouTube's policies. Despite the initial surge this method may offer, the key to long-term success lies in creating and delivering content that resonates with viewers.

  5. Lasik eye surgery in Delhi presents a cutting-edge solution for individuals striving to correct their vision. This minimally invasive procedure involves reshaping the cornea using a precise laser, aiming to improve sight and reduce dependency on glasses or contact lenses. Reputable clinics in Delhi boast state-of-the-art technology and experienced surgeons, offering customised treatments to meet unique visual requirements. Patients benefit from a short recovery period and a remarkable improvement in vision, making Lasik a preferred choice for vision correction in the capital city.

  6. Этот комментарий был удален автором.

  7. Buying YouTube views is essentially buying the appearance of popularity. It's an investment that inflates video view counts artificially, often with the intent of escalating a channel's visibility and influence on the platform. Providers pitch it as a shortcut to credibility, luring creators with the prospect of tipping the scales in YouTube's algorithmic rankings. Yet, the practice bears inherent risks, not least of which is the potential breach of YouTube's terms of service—a violation that could result in penalties or channel deletion. More critically, it circumvents the organic construction of a dedicated viewer base. While it may boost numbers quickly, it lacks the substance of genuine user engagement and fails to cultivate the indispensable asset of creator-audience trust.

  8. Cheap web hosting in India bridges the gap between cost and accessibility for those stepping into the digital world. Offering essential services like ample storage and bandwidth, they are ideal for bloggers and small businesses. With localized servers, these hosting options ensure quick loading times, key for user engagement. They simplify the technical side with user-friendly interfaces and easy CMS installations. While they might lack in scalability and high-end features, the cost-benefit ratio is a major draw. These services democratize the Indian digital landscape, empowering users to take their first online steps affordably.

  9. As a strategy to falsely amplify a YouTube channel's popularity, buying subscribers is enticing but ill-advised. It offers a quick fix to enhance the channel's image but lacks the benefit of true viewer engagement. The subscribers obtained through such transactions are often bots or inactive accounts, offering no real interaction or contribution to a channel's community. This practice not only risks contravening YouTube's community guidelines but also undermines the authenticity needed for genuine growth. Moreover, it can lead to negative consequences such as the loss of subscribers and potential channel suspension. For sustainable success, creators are encouraged to focus on organic growth through valuable content and legitimate viewer engagement.

  10. Purchasing Google reviews is akin to venturing into a minefield regarding online business reputation. Businesses may be tempted to swiftly enhance their appeal by buying fake reviews; however, such deceptive acts are not only against Google's guidelines but tarnish the trust of genuine customers. The short-lived spike in ratings fails to compensate for the long-term damage to credibility and the risk of punitive actions from Google, including the erasure of fraudulent reviews and potential legal implications. The authentic alternative—encouraging real customer feedback—not only aligns with ethical standards but solidifies a foundation of trust and loyalty, critical for any business aiming for longevity and respect in the digital marketplace.

  11. Within the vibrant cityscape of Singapore, the nursing profession is both revered and progressive, offering healthcare professionals a chance to excel in a system renowned for its efficiency and innovation. Nurses here engage with cutting-edge medical technologies within top-tier hospitals and clinics, contributing to a healthcare system that is rated among the best globally. The government incentives for continual learning and professional development make Singapore a magnet for nursing talent. High remuneration packages alongside a high standard of living provide further attraction. The inclusive and multicultural environment also ensures that international nurses feel welcome and valued, making Singapore not just a place of work but also a home for professional excellence in nursing.

  12. Discover India's premium yet affordable web hosting, where low cost meets high efficiency. Striking an ideal balance, our services offer powerful performance, a 99.9% uptime guarantee, and user-friendly tools that cater to both novice and professional users. Benefit from fast-loading websites, robust security, and scalable resources that grow with your needs. Our responsive 24/7 support team ensures your web presence is consistently top-notch. Indulge in cost-effective hosting that doesn't compromise on delivering a stellar online experience. Choose us for seamless, wallet-friendly web hosting excellence.

  13. Seize the competitive edge for your business with our specialized bulk Google reviews service in India. Tap into the power of positive testimonials, carefully curated to reflect the satisfaction of your real customers. Enhance your brand's visibility and credibility, while significantly boosting your search engine rankings and local SEO presence. Our packages are cost-efficient, providing a high return on investment by drawing more organic traffic and increasing conversions. With us, authenticity is paramount; every review is crafted to align with your customer's true experience. Benefit from a seamless buying experience, backed by our dedicated support team ensuring you're never alone in your journey to digital excellence. Join a multitude of satisfied Indian businesses that have already elevated their online reputation with our trustworthy bulk Google reviews.

  14. In the competitive world of music streaming, gaining visibility on platforms like Spotify is crucial. With our cost-effective solution, you can now purchase Spotify followers at unbeatable prices. Strengthen your online presence and attract more listeners to your music effortlessly. Our services are tailored to fit any budget, making it easier for independent artists to thrive in the digital landscape. Say goodbye to struggling for recognition and hello to a growing fanbase. Invest in your music career wisely and watch your popularity soar on Spotify. Don't miss out on this opportunity to stand out in the crowded music scene. Take the first step towards success today by purchasing Spotify followers at pocket-friendly rates. Elevate your profile, increase your streams, and unlock new opportunities for your music. Join countless satisfied artists who have already experienced the benefits of our affordable follower packages. Don't wait any longer – start building your Spotify empire now!

  15. Looking to boost your Twitch channel instantly? Consider the option to buy instant Twitch followers and jumpstart your streaming career! Purchasing followers can give your channel the initial momentum it needs to attract more viewers and engagement. Increase your follower count and enhance your credibility as a content creator. Don't let your channel struggle for recognition – invest in instant followers and stand out from the competition. With more followers, you'll have a better chance of getting noticed by Twitch algorithms and ranking higher in searches. Take control of your streaming success and buy instant Twitch followers today. Elevate your channel and reach a wider audience with this strategic investment. Join the growing number of streamers who have utilized this method to accelerate their growth. Maximize your potential and achieve the recognition you deserve on Twitch!

  16. Need a quick boost for your YouTube channel? Consider purchasing fast YouTube views. With rapid views, you can jumpstart your visibility and increase your reach in no time. Say goodbye to waiting around for growth and hello to instant results. Buying fast YouTube views is a shortcut to success in the competitive online landscape. Speed up your journey to becoming a YouTube sensation with this strategic investment. Quality views delivered swiftly ensure your content gets noticed when it matters most. Don't miss out on the opportunity to skyrocket your channel's popularity. Take action today and buy fast YouTube views to make an immediate impact.

  17. Experience the pinnacle of vision correction with Silk Surgery in India. Our advanced procedure offers precise and personalized solutions for refractive errors. Say goodbye to glasses and contacts as we reshape your vision with cutting-edge technology. Trust our skilled surgeons to deliver optimal results tailored to your unique needs. Rediscover the world with clarity and confidence, free from the constraints of poor vision. Silk Surgery ensures safety and effectiveness, providing a life-changing solution for various eye conditions. Embrace clear vision and a brighter future through our innovative approach to eye care.

  18. Experience the transformative magic of Smile Pro Eye Treatment. Say goodbye to tired, puffy eyes and hello to a refreshed, youthful gaze. Our innovative approach combines advanced technology with expert care to rejuvenate your eyes effectively and safely. Rediscover confidence as your eyes sparkle with renewed brightness and vitality. Trust in our dedicated team to tailor each treatment to your unique needs, ensuring optimal results. Embrace the beauty of radiant eyes with Smile Pro Eye Treatment, where every session is a step towards a more vibrant you. Say hello to a brighter future with the Smile Pro difference.

  19. Welcome to Smile Pro Eye Clinic in Delhi, where we specialize in rejuvenating your gaze with precision and care. Our expert team utilizes advanced techniques to enhance your natural beauty and boost your confidence. Say goodbye to tired eyes and hello to a refreshed, youthful appearance with our personalized treatments. Whether you seek to reduce under-eye bags, wrinkles, or enhance your eye aesthetics, we've got you covered. Trust in our commitment to excellence as we redefine eye care in the heart of Delhi. Let your eyes sparkle with newfound radiance at Smile Pro Eye Clinic, where every smile begins with brighter eyes.

  20. Searching for top-quality trophies? Look no further than trophy manufacturers in India! With unparalleled craftsmanship and attention to detail, our trophies stand out. Whether for sports, corporate events, or academic achievements, we have the perfect trophy for you. Elevate your awards ceremony with our exquisite designs and customization options. Proudly made in India, our trophies reflect excellence and prestige. Trust the expertise of India's finest trophy manufacturers for your recognition needs. Order now and celebrate success with distinction!

  21. Need legal guidance for your matrimonial matters? Look no further than the best matrimonial lawyer in Delhi! With expertise in family law, we offer compassionate support and strategic counsel. Trust us to navigate through complexities and protect your rights. Our personalized approach ensures tailored solutions for your unique situation. Whether it's divorce, child custody, or alimony disputes, we're here to advocate for you. Don't face these challenges alone—reach out to the top matrimonial lawyer in Delhi today for peace of mind and a favorable resolution.

  22. Colorectal cancer specialists in Ahmedabad stand as pioneers in the field of oncology, combining cutting-edge treatment options with a deeply personal approach to patient care. With a focus on utilizing the latest in surgical techniques, chemotherapy, and targeted therapies, these experts are dedicated to offering treatments that are both effective and tailored to the patient's specific needs. Their expertise extends to innovative diagnostic tools that aid in early detection and treatment planning, reflecting a comprehensive approach to battling colorectal cancer. Beyond their clinical skills, these specialists are known for their compassionate support and communication, ensuring that every patient feels heard, understood, and never alone in their journey. In the bustling healthcare landscape of Ahmedabad, they represent a blend of technical excellence and heartfelt empathy, dedicated to improving outcomes and enhancing the quality of life for their patients.

  23. Breast cancer specialists in Gurgaon are renowned for blending exceptional medical acumen with compassionate patient care. Leveraging the most advanced technologies and therapeutic methods, they provide personalized treatments tailored to meet the unique needs and circumstances of each patient. Their approach is holistic, ensuring that patients receive comprehensive support that addresses not just the physical implications of breast cancer but also its psychological and emotional aspects. These specialists are at the forefront of medical research, continuously integrating the latest scientific discoveries into their practice to improve patient outcomes. They place a high value on patient education, empowering those they treat with the knowledge to make informed decisions about their health care. Their dedication to their patients' well-being and recovery sets them apart, making them highly respected figures in the medical community of Gurgaon.

  24. Are you a qualified nurse seeking opportunities in the UK but don't have an IELTS score? Look no further! Our agency specializes in connecting skilled nurses with UK healthcare facilities without the need for an IELTS certification. Join our network of healthcare professionals and unlock a world of career possibilities. We understand the challenges of obtaining language proficiency tests and offer pathways to employment without this requirement. With a shortage of nurses in the UK, now is the perfect time to pursue your dream job. Benefit from competitive salaries, career advancement opportunities, and a supportive work environment. Take the first step towards your UK nursing career today. Contact us to explore your options and start your journey to success!

  25. Looking to boost your YouTube channel's credibility? Buy Legit YouTube Subscribers from us and watch your audience grow authentically. Our service delivers genuine subscribers who engage with your content, increasing your channel's visibility and reach. Say goodbye to fake accounts and unreliable growth tactics – we provide real results that you can trust. With our transparent and secure process, you can rest assured that your subscriber base is legitimate. Expand your channel's influence and attract more viewers with our legit subscriber service. Don't settle for inflated numbers – invest in authentic growth for your YouTube channel today. Experience the power of genuine subscribers and elevate your online presence to new heights. Unlock the potential of legit YouTube Subscribers and achieve success with integrity.

  26. Looking to boost your YouTube presence? Buy online YouTube subscribers and amplify your channel's reach effortlessly. With a few clicks, watch your subscriber count soar, giving your content instant credibility. Increase your visibility and attract organic viewership with a larger subscriber base. Gain a competitive edge in the crowded online space and stand out from the crowd. Choose from a variety of packages tailored to suit your needs and budget. Enhance your channel's authority and attract advertisers and collaborators. Rest assured, our services adhere to YouTube's guidelines for safe and effective growth. Invest in your success today and watch your channel thrive with purchased YouTube subscribers. Unlock the potential for greater engagement and monetization opportunities.

  27. Looking to boost your YouTube presence? Consider leveraging the option to purchase inexpensive YouTube subscribers. It's a strategy that many content creators utilize to kickstart their channels. Increasing your subscriber count can enhance your channel's credibility and visibility. However, ensure you're purchasing from reputable sources to avoid any negative repercussions. Remember, quality content remains the ultimate key to long-term success on YouTube. So, while buying subscribers can give you a quick boost, focus on creating engaging content to retain and grow your audience organically. Explore your options wisely and make informed decisions to support your channel's growth effectively.

  28. Its an interesting and useful information. We all get highly motivation from this .
    Maldives Tour Packages