NO One Tell YOU | Secret AWS Vulnerabilities -Part 3

Firstly, I would like to thank everyone for their support during AWS Parts 1 and 2.

In this continuation of the AWS (Amazon Web Services) checklist, the focus stays on important measures to commence your exploration into the cloud computing platform. We have gone through the AWS checklist part 1 and part 2, Part 3 expands on additional topics by exploring more sophisticated ideas and industry best practices.

In this blog, I'm going through the below AWS Components- Recently In one of the Penetration Testing I have Identified many Critical, High and Medium Issues in these Components.

API Gateway

AWS AppSync

MediaPackage

Code Build

CloudFormation

SSM Parameter Store

Kinesis

EventBridge

CloudFront

Lambda

Cognito

1. Mishandling of API keys — API Gateway

Mishandling API keys in API Gateway can pose significant security risks, as API keys are a form of authentication that controls access to the API resources. If API keys are mishandled, it can lead to unauthorized access, data breaches, and other security issues.

Threat Actor: Storing API keys directly in source code, configuration files, or client-side code exposes them to unauthorized access.

If API keys are exposed, unauthorized individuals or entities may gain access to your AWS AppSync APIs. This can result in data theft, unauthorized modifications, or disruptions to your application

2. Mishandling of API keys — AWS AppSync

AWS AppSync is a fully managed service that makes it easy to develop GraphQL APIs by handling the heavy lifting of securely connecting to data sources like AWS DynamoDB, Lambda, or any HTTP data source.

Threat Actor: If API keys are exposed, unauthorized individuals or entities may gain access to your AWS AppSync APIs. This can result in data theft, unauthorized modifications, or disruptions to your application

3. Sensitive Data in Env Variable and Lambda Applications

The concerned lambda functions store sensitive information in clear text, in environment variable configurations.

The lambda env variable secrets are not encrypted in transit. When dealing with Lambda function environment variables that hold tokens, it is highly recommended to implement encryption to protect the data you dynamically pass to your functions.

Threat Actor:

Threat Actor can exploit this exposure to gain access to sensitive data and potentially compromise other resources in your AWS environment

4. MediaPackage HLS Endpoints — Disclosing Sensitive Information — User Credentials

If MediaPackage HLS ingest endpoints display username and password information in plaintext, it represents a significant security risk. Exposing sensitive credentials in this manner poses a threat to the security of content delivery infrastructure.

Threat Actor: Storing username and password information in configurations, especially in plaintext, is a security risk and is not recommended. If you have sensitive information, such as credentials, stored in your MediaPackage HLS endpoints, it's important to take steps to secure this information to prevent unauthorized access and potential security breaches.

5. Sensitive Data Exposure in Code Build

Exposing sensitive information in build logs, particularly in CI/CD (Continuous Integration/Continuous Deployment) environments is a security concern. Build logs often contain sensitive information such as credentials, environment variables, API keys, and other build process details. If this information is exposed, it can lead to security vulnerabilities and potential unauthorized access.

Threat Actor: Exposing sensitive information such as credentials, API keys, or access tokens in build logs increases the risk of unauthorized access. Sensitive information exposed in build logs may lead to a data breach

6. Default Root Object should be configured for CloudFormation Distributions

Configuring a default root object for Amazon CloudFront distributions ensures that when users access the distribution's root URL, it automatically serves the specified default object. By setting a default root object, such as "index.html," CloudFront automatically serves it when users access the root URL. This protects the distribution content against unauthorized access, simplifies navigation, improves load times, and enhances overall usability, making it easier for visitors to interact with your website or web application.

Threat Actor: Without a default root object, if a viewer requests the root URL, CloudFront might return a directory listing if the underlying origin (e.g., an S3 bucket) doesn't have an index document.

Users accessing the root URL may see an unskilled or generic directory listing page instead of a proper landing page. This can negatively impact user experience and the professional appearance of your site.

7. Secrets Exposed in Parameter Store

The IAM Readonly policy gives access to get/list/decrypt the configuration and secrets from the Parameter Store of AWS SSM

Threat Actor:

If the attacker gains access to critical secrets, they may use them to compromise other services within the AWS environment.

8. Encryption Should be Enabled for CodeBuild Artifacts

Enabling encryption for CodeBuild artifacts is an important security practice that helps protect sensitive data and artifacts produced during the build process. If encryption is not enabled for CodeBuild artifacts, it could have several security implications.

Threat Actor: Without encryption, artifacts produced by the build process, such as compiled code, binaries, or other sensitive files, are stored in an unencrypted format.

Unencrypted artifacts may be susceptible to unauthorized access if the artifact storage location is accessible by individuals who should not have access.

Build artifacts may contain sensitive information, such as API keys, credentials, or configuration files, which, if left unencrypted, could be exposed.

9. Field-Level Encryption Should be Enabled for CloudFormation Distributions

Field-level encryption for Amazon CloudFront distributions is a security feature that allows you to encrypt sensitive data at the field level, adding an extra layer of protection to data in transit.

With Amazon CloudFront field-level encryption, you add layer of security, along with SSL encryption (HTTPS), that lets you protect specific sensitive data throughout system processing so that only certain applications within your environment can see this data.

Threat Actor: Without field-level encryption, sensitive data in HTTP headers or query parameters may be transmitted over the internet in plaintext. Attackers or malicious entities could potentially intercept and view sensitive data during transit, leading to data exposure and potential security breaches.

10. Package Encryption Should be Enabled for MediaPackage Delivering Content

If package encryption is not enabled for AWS Elemental MediaPackage, it could have security implications, especially when delivering content over HTTP Live Streaming (HLS) or Dynamic Adaptive Streaming over HTTP (DASH).

Threat Actor Description Risk Impacts: Without encryption, the content delivered by MediaPackage may be transmitted in plaintext over the network. Lack of encryption increases the risk of data tampering or modification during transit.

If content includes sensitive information, such as personal or confidential data, transmitting it without encryption poses a security risk.

11. Firehose Delivering Stream Server Side Encryption / Kinesis SSE Should be Enabled

If Server-Side Encryption (SSE) is found to be disabled for Amazon Kinesis Data Firehose Delivery Stream, it can have several security implications, particularly in terms of data confidentiality and compliance with security best practices.

Threat Actor Description Risk Impacts: The lack of encryption increases the risk of unauthorized access to the stored data, potentially exposing sensitive information. Without encryption, there's an increased risk of data tampering or unauthorized modification.

12. Make sure Lambda Is Using the Latest Runtime Environment

It's important to note that AWS Lambda users should keep their Lambda functions up-to-date with the latest supported runtime versions to benefit from improvements and security patches. When you execute your Lambda functions using the latest version of the implemented runtime environment, you should benefit from new features and enhancements, better security, performance and reliability.

Threat Actor Description Risk Impacts: Outdated runtime environments may have known security vulnerabilities that have been patched in newer versions. Using an outdated runtime increases the risk of exposing your functions to security threats. AWS may eventually stop providing support and updates for older runtime versions. This means you won't receive critical bug fixes, security patches, or performance improvements.

13. Origin Failover Should not be Disabled

Origin Failover is a feature in Amazon CloudFront that allows you to configure backup origins for your distribution. When the primary origin becomes unavailable, CloudFront automatically switches to the backup origin to ensure continuity of content delivery.

Threat Actor Description Risk Impacts: Without automatic failover to a backup origin, the risk of prolonged service disruptions due to DDoS attacks is higher. Failover can help distribute traffic to alternative origins, mitigating the impact of DDoS.

14. CloudFront Geo Restriction Should be Implemented

With Amazon CloudFront geo restriction you can block IP addresses based on Geo IP from reaching your Content Delivery Network (CDN) distribution content. The feature can also be used to assist in mitigation of Distributed Denial of Service (DDoS) attacks.

Threat Actor Description Risk Impacts: Without Geo Restriction, content is accessible from any location globally. This expanded accessibility may increase the attack surface for potential threats, including distributed denial-of-service (DDoS) attacks or malicious traffic from specific regions.

Malicious actors might specifically target vulnerabilities or launch attacks from specific geographic regions. Geo Restriction can help mitigate such risks by limiting access to the content from certain regions.

15. Resource Based Policy Should be Implemented for EventBridge Bus

For Amazon EventBridge (previously known as Amazon CloudWatch Events) buses, implementing a resource-based policy is a crucial security precaution that enables you to manage event bus access and specify who is permitted to deliver events to it. A resource-based policy outlines which AWS identities or accounts are permitted to carry out specific operations on a given resource (in this case, an event bus) and sets the permissions for that resource.

Threat Actor Description Risk Impacts: Without a resource-based policy, there's a risk of unauthorized AWS accounts or identities sending events to the event bus. Malicious or unauthorized entities may attempt to inject events into the bus, leading to potential security issues or unintended processing of events.

16. The API Endpoint should be Configured Properly

With a private API endpoint configuration, the traffic to your Amazon API Gateway APIs uses secure connections and does not leave the AWS network. Having private API endpoints for your REST APIs allows you to use all API Gateway service features, while securely connecting them to other AWS cloud services and resources inside your Virtual Private Cloud (VPC).

Threat Actor Description Risk Impacts: API Private Endpoint is a configuration that allows you to expose an API in a private network environment instead of making it publicly accessible over the internet. It provides secure and private access to your API resources, typically within a Virtual Private Cloud (VPC) or a private subnet

Analysis: https://console.aws.amazon.com/apigateway/

Replication Steps:

1. Sign in to the AWS Management Console.
2. Navigate to API Gateway console at https://console.aws.amazon.com/apigateway/3.

In the main navigation panel, select APIs to access your API Gateway APIs.

17. CloudFront should be Integrated with WAF

With CloudFront — WAF integration enabled, you will be able to block any malicious requests made to the Content Delivery Network (CDN) based on the criteria defined in the web Access Control List (web ACL) associated with the CDN distribution.

Threat Actor Description Risk Impacts: Without WAF integration, CloudFront distribution is more vulnerable to DDoS attacks, potentially leading to service interruptions and increased operational overhead.

Malicious bots can scrape content, perform credential-stuffing attacks, or conduct other automated activities that may negatively impact your application.

18. AWS WAF should be Enabled for Cognito and AppSync

Enabling AWS Web Application Firewall (WAF) for Amazon Cognito and AWS AppSync adds layer of security by protecting the applications against common web exploits and attacks.

Threat Actor Description Risk Impacts: WAF provides DDoS (Distributed Denial of Service) protection and different other attacks, which helps mitigate the impact of volumetric attacks on your Cognito authentication infrastructure.

WAF helps protect the GraphQL and RESTful APIs exposed through AppSync from common web attacks, such as injection attacks and malicious input.

19. Enable Encryption at Rest for Environment Variable Using Customer Master Keys

Encrypting environment variables using Customer Master Keys (CMKs) in AWS is a best practice for securing sensitive information stored in environment variables, such as API keys, database passwords, or other secrets. Environment variables often contain sensitive information such as API keys, database passwords, or other secrets. Without encryption, this sensitive data is stored in plaintext in the environment variables. If someone gains access to your environment variables, they can easily read and misuse this information.

Threat Actor Description Risk Impacts: Storing sensitive data in plaintext increases the risk of data breaches. If AWS resources, including Lambda functions, are compromised, an attacker could access and exfiltrate the sensitive data stored in your environment variables.

20. Enable Origin Access Control for Distributions with S3 Origin

Origin Access Identity (OAI) and Origin Access Control (OAC) are security features in Amazon CloudFront that help control access to the origin (such as an Amazon S3 bucket) and enhance the security of content delivery.

Threat Actor Description Risk Impacts: Without Origin Access Control, the S3 bucket used as the origin is accessible directly over the internet, not just through CloudFront. Lack of Origin Access Control might lead to misconfigurations or oversights in the security settings of the S3 bucket itself, making it susceptible to security vulnerabilities.

I hope you guys like this checklist — The checklist makes it simple for teams to identify what needs to be changed or improved upon by offering simple and practical recommendations.

If you have not gone through with Part 1 and Part 2 — Here Below are the references

Reference Part 1:

AWS Vulnerability Assessment and Penetration Testing Checklist- Part 1 In this blog, I am sharing my experience with AWS vulnerabilities that have been identified during AWS security…

Reference Part 2:

AWS Vulnerability Assessment and Penetration Testing Checklist- Part 2 In this blog, I am sharing my experience with AWS vulnerabilities that have been identified during AWS security…

LinkedIn: https://www.linkedin.com/in/rsecsharma/