Adrian Johnson
TLDR:
- AWS has critical flaws that can lead to RCE, data theft, and full-service takeovers
- Attack vector called Shadow Resource allows malicious actors to exploit vulnerabilities
Cybersecurity researchers have uncovered severe flaws in Amazon Web Services (AWS) offerings that could have serious consequences if exploited. These vulnerabilities, ranging from remote code execution (RCE) to full-service user takeovers, were discovered by cloud security firm Aqua and presented at Black Hat USA 2024. Central to the issue is the attack vector known as Shadow Resource, which allows attackers to automatically create AWS S3 buckets in unused regions, waiting for legitimate customers to use vulnerable services and granting covert access to their contents.
Aqua found that multiple AWS services use similar naming conventions for S3 buckets, exposing them to Shadow Resource attacks. This could lead to privilege escalation, data manipulation, and DoS conditions. While Amazon has addressed these vulnerabilities, it is crucial for organizations to implement unique identifiers for S3 bucket names to prevent unauthorized access. The implications of these flaws extend beyond AWS services to open-source projects that create S3 buckets automatically, making it imperative for organizations to prioritize secure naming conventions to protect their data.
