пятница, 8 августа 2014 г.

SSRF vs AWS Security

Hello everyone...

Just want to mention one attack-vector that is useful against AWS EC2 instances in some configurations. It is not rocket-science, but pretty fun and tell us about AWS Cloud security things and maybe can help us to do hardening. Actually I am talking about boring-sold SSRF vector. So if an attacker can do SSRF in our EC2 with SSRF what he can do?

Sometimes developers like to assign IAM Roles to instances. For example if it is deploy/build server, that needs to create new apps in AWS account or something else, doesn't matter - this just happens 8) And assigning roles to EC2 instances  - easiest way you can do it, because you do not need to think about how to deliver  Access Keys to the instance, how to rotate them and etc. Now back to SSRF...

So we have classic vulnerable App with boring XXE:


And...





Now it's time to remember about AWS meta-data service which is available from any instance. This server return meta-data for EC2 instance that called this API: http://169.254.169.254/latest/meta-data
Let's try:


Ok... so now you can get a  lot of information... but the funniest part - Temporary Access Key and Token for AWS API is also here http://169.254.169.254/latest/meta-data/iam/security-credentials/<ROLE_NAME>...



Wow, 'apache' user got this key... and if you think that by default access with this key limited only from EC2 instance - you wrong. Please feel free to copy this key and use it from any place.

Config:



Trying:



















Now we can do anything that allowed by Policy/Role that assigned to hacked instance.

Let's summarize problems:

1) Anyone can get Access Key: nobody, root, apache... it's not based on OS security.
2) By default this Key works from any IP, not only from instance (but you can try to configure it in Policy at least)
3) You can't revoke this Key. You can remove Policy from the group - yes.
4) You do SSRF in your code, smart-ass!

So this is just  example how SSRF + lack of hardening on AWS account can ruin you life...



Solution for item 2, edit Policies that assigned to Role:

    "Condition": {
        "IpAddress": {
        "aws:SourceIp": "10.90.X.X"
         }
     }

Then you safe:


But in fact not - if box compromised or with the saem SSRF you can makes RESP API calls from the pwned isntance...

As final notes:

1) Check roles that assigned to instances. Less privileges... Better no roles...
2) If you can limit access for this policy by SRC IP -  do it, so only instances with this Role can access API.
BUT remember, if you have SSRF, than attacker can do API calls from tsame instance by same SSRF...
3) Do not code SSRF ;)

P.S. Thanks to Erian Nader from HERE Security team for helping with this material...

P.P.S. And of course, it's not about only SSRF - if instance pwned, then same risks applied. So be careful with Instance's roles!

32 комментария:

  1. Understanding the pricing structure and available packages is essential for a budget-friendly experience visit body massage in bangalore

    ОтветитьУдалить
  2. From various massage parlour near me techniques to ambiance considerations, we'll cover it all, ensuring you make an informed choice for a serene experience.

    ОтветитьУдалить
  3. Combining acupressure body massage near me energy balance, it goes beyond the superficial, delving into the core of physical and mental well-being......

    ОтветитьУдалить
  4. Buy YouTube Subscribers" offers a rapid way for creators to increase their channel's following, enhancing their perceived popularity. It's important to ensure the purchased subscribers are genuine to comply with YouTube's policies. Despite the initial surge this method may offer, the key to long-term success lies in creating and delivering content that resonates with viewers.
    https://www.buyyoutubesubscribers.in/

    ОтветитьУдалить
  5. Lasik eye surgery in Delhi presents a cutting-edge solution for individuals striving to correct their vision. This minimally invasive procedure involves reshaping the cornea using a precise laser, aiming to improve sight and reduce dependency on glasses or contact lenses. Reputable clinics in Delhi boast state-of-the-art technology and experienced surgeons, offering customised treatments to meet unique visual requirements. Patients benefit from a short recovery period and a remarkable improvement in vision, making Lasik a preferred choice for vision correction in the capital city.
    https://www.visualaidscentre.com/lasik-eye-surgery/

    ОтветитьУдалить
  6. Этот комментарий был удален автором.

    ОтветитьУдалить
  7. Buying YouTube views is essentially buying the appearance of popularity. It's an investment that inflates video view counts artificially, often with the intent of escalating a channel's visibility and influence on the platform. Providers pitch it as a shortcut to credibility, luring creators with the prospect of tipping the scales in YouTube's algorithmic rankings. Yet, the practice bears inherent risks, not least of which is the potential breach of YouTube's terms of service—a violation that could result in penalties or channel deletion. More critically, it circumvents the organic construction of a dedicated viewer base. While it may boost numbers quickly, it lacks the substance of genuine user engagement and fails to cultivate the indispensable asset of creator-audience trust.
    https://www.buyyoutubeviewsindia.in/

    ОтветитьУдалить
  8. Cheap web hosting in India bridges the gap between cost and accessibility for those stepping into the digital world. Offering essential services like ample storage and bandwidth, they are ideal for bloggers and small businesses. With localized servers, these hosting options ensure quick loading times, key for user engagement. They simplify the technical side with user-friendly interfaces and easy CMS installations. While they might lack in scalability and high-end features, the cost-benefit ratio is a major draw. These services democratize the Indian digital landscape, empowering users to take their first online steps affordably.
    https://onohosting.com/

    ОтветитьУдалить
  9. As a strategy to falsely amplify a YouTube channel's popularity, buying subscribers is enticing but ill-advised. It offers a quick fix to enhance the channel's image but lacks the benefit of true viewer engagement. The subscribers obtained through such transactions are often bots or inactive accounts, offering no real interaction or contribution to a channel's community. This practice not only risks contravening YouTube's community guidelines but also undermines the authenticity needed for genuine growth. Moreover, it can lead to negative consequences such as the loss of subscribers and potential channel suspension. For sustainable success, creators are encouraged to focus on organic growth through valuable content and legitimate viewer engagement.
    https://buyyoutubesubscribersindia.weebly.com/

    ОтветитьУдалить
  10. Purchasing Google reviews is akin to venturing into a minefield regarding online business reputation. Businesses may be tempted to swiftly enhance their appeal by buying fake reviews; however, such deceptive acts are not only against Google's guidelines but tarnish the trust of genuine customers. The short-lived spike in ratings fails to compensate for the long-term damage to credibility and the risk of punitive actions from Google, including the erasure of fraudulent reviews and potential legal implications. The authentic alternative—encouraging real customer feedback—not only aligns with ethical standards but solidifies a foundation of trust and loyalty, critical for any business aiming for longevity and respect in the digital marketplace.
    https://www.seoexpertindelhi.in/buy-google-reviews/

    ОтветитьУдалить
  11. Within the vibrant cityscape of Singapore, the nursing profession is both revered and progressive, offering healthcare professionals a chance to excel in a system renowned for its efficiency and innovation. Nurses here engage with cutting-edge medical technologies within top-tier hospitals and clinics, contributing to a healthcare system that is rated among the best globally. The government incentives for continual learning and professional development make Singapore a magnet for nursing talent. High remuneration packages alongside a high standard of living provide further attraction. The inclusive and multicultural environment also ensures that international nurses feel welcome and valued, making Singapore not just a place of work but also a home for professional excellence in nursing.
    https://dynamichealthstaff.com/nursing-jobs-in-singapore-for-indian-nurses

    ОтветитьУдалить
  12. Discover India's premium yet affordable web hosting, where low cost meets high efficiency. Striking an ideal balance, our services offer powerful performance, a 99.9% uptime guarantee, and user-friendly tools that cater to both novice and professional users. Benefit from fast-loading websites, robust security, and scalable resources that grow with your needs. Our responsive 24/7 support team ensures your web presence is consistently top-notch. Indulge in cost-effective hosting that doesn't compromise on delivering a stellar online experience. Choose us for seamless, wallet-friendly web hosting excellence.
    https://hostinglelo.in/

    ОтветитьУдалить
  13. Seize the competitive edge for your business with our specialized bulk Google reviews service in India. Tap into the power of positive testimonials, carefully curated to reflect the satisfaction of your real customers. Enhance your brand's visibility and credibility, while significantly boosting your search engine rankings and local SEO presence. Our packages are cost-efficient, providing a high return on investment by drawing more organic traffic and increasing conversions. With us, authenticity is paramount; every review is crafted to align with your customer's true experience. Benefit from a seamless buying experience, backed by our dedicated support team ensuring you're never alone in your journey to digital excellence. Join a multitude of satisfied Indian businesses that have already elevated their online reputation with our trustworthy bulk Google reviews.
    https://www.sandeepmehta.co.in/buy-google-reviews/

    ОтветитьУдалить
  14. In the competitive world of music streaming, gaining visibility on platforms like Spotify is crucial. With our cost-effective solution, you can now purchase Spotify followers at unbeatable prices. Strengthen your online presence and attract more listeners to your music effortlessly. Our services are tailored to fit any budget, making it easier for independent artists to thrive in the digital landscape. Say goodbye to struggling for recognition and hello to a growing fanbase. Invest in your music career wisely and watch your popularity soar on Spotify. Don't miss out on this opportunity to stand out in the crowded music scene. Take the first step towards success today by purchasing Spotify followers at pocket-friendly rates. Elevate your profile, increase your streams, and unlock new opportunities for your music. Join countless satisfied artists who have already experienced the benefits of our affordable follower packages. Don't wait any longer – start building your Spotify empire now!
    https://www.spotifyfame.com/

    ОтветитьУдалить
  15. Looking to boost your Twitch channel instantly? Consider the option to buy instant Twitch followers and jumpstart your streaming career! Purchasing followers can give your channel the initial momentum it needs to attract more viewers and engagement. Increase your follower count and enhance your credibility as a content creator. Don't let your channel struggle for recognition – invest in instant followers and stand out from the competition. With more followers, you'll have a better chance of getting noticed by Twitch algorithms and ranking higher in searches. Take control of your streaming success and buy instant Twitch followers today. Elevate your channel and reach a wider audience with this strategic investment. Join the growing number of streamers who have utilized this method to accelerate their growth. Maximize your potential and achieve the recognition you deserve on Twitch!
    https://twitchviral.com/

    ОтветитьУдалить
  16. Need a quick boost for your YouTube channel? Consider purchasing fast YouTube views. With rapid views, you can jumpstart your visibility and increase your reach in no time. Say goodbye to waiting around for growth and hello to instant results. Buying fast YouTube views is a shortcut to success in the competitive online landscape. Speed up your journey to becoming a YouTube sensation with this strategic investment. Quality views delivered swiftly ensure your content gets noticed when it matters most. Don't miss out on the opportunity to skyrocket your channel's popularity. Take action today and buy fast YouTube views to make an immediate impact.
    https://sites.google.com/site/buyytviewindia/

    ОтветитьУдалить
  17. Experience the pinnacle of vision correction with Silk Surgery in India. Our advanced procedure offers precise and personalized solutions for refractive errors. Say goodbye to glasses and contacts as we reshape your vision with cutting-edge technology. Trust our skilled surgeons to deliver optimal results tailored to your unique needs. Rediscover the world with clarity and confidence, free from the constraints of poor vision. Silk Surgery ensures safety and effectiveness, providing a life-changing solution for various eye conditions. Embrace clear vision and a brighter future through our innovative approach to eye care.
    https://medium.com/@pojagupta/silk-eye-surgery-elita-860c70c593ad

    ОтветитьУдалить
  18. Experience the transformative magic of Smile Pro Eye Treatment. Say goodbye to tired, puffy eyes and hello to a refreshed, youthful gaze. Our innovative approach combines advanced technology with expert care to rejuvenate your eyes effectively and safely. Rediscover confidence as your eyes sparkle with renewed brightness and vitality. Trust in our dedicated team to tailor each treatment to your unique needs, ensuring optimal results. Embrace the beauty of radiant eyes with Smile Pro Eye Treatment, where every session is a step towards a more vibrant you. Say hello to a brighter future with the Smile Pro difference.
    https://smileproeyesurgery.medium.com/smile-pro-eye-surgery-in-delhi-fbafc721a9ce

    ОтветитьУдалить
  19. Welcome to Smile Pro Eye Clinic in Delhi, where we specialize in rejuvenating your gaze with precision and care. Our expert team utilizes advanced techniques to enhance your natural beauty and boost your confidence. Say goodbye to tired eyes and hello to a refreshed, youthful appearance with our personalized treatments. Whether you seek to reduce under-eye bags, wrinkles, or enhance your eye aesthetics, we've got you covered. Trust in our commitment to excellence as we redefine eye care in the heart of Delhi. Let your eyes sparkle with newfound radiance at Smile Pro Eye Clinic, where every smile begins with brighter eyes.
    https://www.linkedin.com/pulse/smile-pro-eye-surgery-delhi-romila-chaudhary-y5imc/

    ОтветитьУдалить
  20. Searching for top-quality trophies? Look no further than trophy manufacturers in India! With unparalleled craftsmanship and attention to detail, our trophies stand out. Whether for sports, corporate events, or academic achievements, we have the perfect trophy for you. Elevate your awards ceremony with our exquisite designs and customization options. Proudly made in India, our trophies reflect excellence and prestige. Trust the expertise of India's finest trophy manufacturers for your recognition needs. Order now and celebrate success with distinction!
    https://www.angelstrophies.com/

    ОтветитьУдалить
  21. Need legal guidance for your matrimonial matters? Look no further than the best matrimonial lawyer in Delhi! With expertise in family law, we offer compassionate support and strategic counsel. Trust us to navigate through complexities and protect your rights. Our personalized approach ensures tailored solutions for your unique situation. Whether it's divorce, child custody, or alimony disputes, we're here to advocate for you. Don't face these challenges alone—reach out to the top matrimonial lawyer in Delhi today for peace of mind and a favorable resolution.
    https://bestdivorcelawyerindelhi.com/

    ОтветитьУдалить
  22. Colorectal cancer specialists in Ahmedabad stand as pioneers in the field of oncology, combining cutting-edge treatment options with a deeply personal approach to patient care. With a focus on utilizing the latest in surgical techniques, chemotherapy, and targeted therapies, these experts are dedicated to offering treatments that are both effective and tailored to the patient's specific needs. Their expertise extends to innovative diagnostic tools that aid in early detection and treatment planning, reflecting a comprehensive approach to battling colorectal cancer. Beyond their clinical skills, these specialists are known for their compassionate support and communication, ensuring that every patient feels heard, understood, and never alone in their journey. In the bustling healthcare landscape of Ahmedabad, they represent a blend of technical excellence and heartfelt empathy, dedicated to improving outcomes and enhancing the quality of life for their patients.
    https://drvirajlavingia.com/

    ОтветитьУдалить
  23. Breast cancer specialists in Gurgaon are renowned for blending exceptional medical acumen with compassionate patient care. Leveraging the most advanced technologies and therapeutic methods, they provide personalized treatments tailored to meet the unique needs and circumstances of each patient. Their approach is holistic, ensuring that patients receive comprehensive support that addresses not just the physical implications of breast cancer but also its psychological and emotional aspects. These specialists are at the forefront of medical research, continuously integrating the latest scientific discoveries into their practice to improve patient outcomes. They place a high value on patient education, empowering those they treat with the knowledge to make informed decisions about their health care. Their dedication to their patients' well-being and recovery sets them apart, making them highly respected figures in the medical community of Gurgaon.
    https://www.breastoncosurgery.com/

    ОтветитьУдалить
  24. Are you a qualified nurse seeking opportunities in the UK but don't have an IELTS score? Look no further! Our agency specializes in connecting skilled nurses with UK healthcare facilities without the need for an IELTS certification. Join our network of healthcare professionals and unlock a world of career possibilities. We understand the challenges of obtaining language proficiency tests and offer pathways to employment without this requirement. With a shortage of nurses in the UK, now is the perfect time to pursue your dream job. Benefit from competitive salaries, career advancement opportunities, and a supportive work environment. Take the first step towards your UK nursing career today. Contact us to explore your options and start your journey to success!
    https://suntechhealthcarepro.com/nursing-jobs-in-uk-without-ielts/

    ОтветитьУдалить