AWS - API Gateway Unauthenticated Enum

Tip

Leer en oefen AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Leer en oefen GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Leer en oefen Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Ondersteun HackTricks

API Invoke bypass

Volgens die praatjie Attack Vectors for APIs Using AWS API Gateway Lambda Authorizers - Alexandre & Leonardo, Lambda Authorizers kan gekonfigureer word using IAM syntax om toestemmings te gee om invoke API endpoints. Dit is geneem from the docs:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Permission",
"Action": ["execute-api:Execution-operation"],
"Resource": [
"arn:aws:execute-api:region:account-id:api-id/stage/METHOD_HTTP_VERB/Resource-path"
]
}
]
}

Die probleem met hierdie manier om permissies te gee om endpoints aan te roep is dat die “*” “alles” impliseer en daar is geen verdere regex-sintaksis ondersteun nie.

Some examples:

  • A rule such as arn:aws:execute-apis:sa-east-1:accid:api-id/prod/*/dashboard/* in order to give each user access to /dashboard/user/{username} will give them access to other routes such as /admin/dashboard/createAdmin for example.

Warning

Note that “*” doesn’t stop expanding with slashes, therefore, if you use “*” in api-id for example, it could also indicate “any stage” or “any method” as long as the final regex is still valid.
So arn:aws:execute-apis:sa-east-1:accid:*/prod/GET/dashboard/*
Can validate a post request to test stage to the path /prod/GET/dashboard/admin for example.

Jy moet altyd duidelik wees oor wat jy wil toelaat en dan nagaan of ander scenario’s moontlik is met die toegekenede permissies.

For more info, apart of the docs, you can find code to implement authorizers in this official aws github.

IAM Policy Injection

In the same talk it’s exposed the fact that if the code is using user input to generate the IAM policies, wildcards (and others such as “.” or specific strings) can be included in there with the goal of bypassing restrictions.

Publieke URL-sjabloon

https://{random_id}.execute-api.{region}.amazonaws.com/{user_provided}

Kry rekening-ID vanaf openbare API Gateway-URL

Net soos met S3 buckets, Data Exchange en Lambda URL gateways, is dit moontlik om die rekening-ID van ’n rekening te vind deur misbruik te maak van die aws:ResourceAccount Policy Condition Key vanaf ’n openbare API Gateway-URL. Dit word gedoen deur die rekening-ID een karakter op ’n slag te vind deur wildcards in die aws:ResourceAccount afdeling van die beleid te misbruik.
Hierdie tegniek maak dit ook moontlik om waardes van tags te kry as jy die tag key ken (daar is ’n paar standaard interessante).

Jy kan meer inligting vind in die oorspronklike navorsing en die hulpmiddel conditional-love om hierdie eksploitasie te outomatiseer.

Tip

Leer en oefen AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Leer en oefen GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Leer en oefen Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Ondersteun HackTricks