AWS - Macie Privesc

Reading time: 2 minutes

tip

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

Macie

For more information about Macie check:

AWS - Macie Enum

Amazon Macie - Bypass Reveal Sample Integrity Check

AWS Macie is a security service that automatically detects sensitive data within AWS environments, such as credentials, personally identifiable information (PII), and other confidential data. When Macie identifies a sensitive credential, such as an AWS secret key stored in an S3 bucket, it generates a finding that allows the owner to view a "sample" of the detected data. Typically, once the sensitive file is removed from the S3 bucket, it is expected that the secret can no longer be retrieved.

However, a bypass has been identified where an attacker with sufficient permissions can re-upload a file with the same name but containing different, non-sensitive dummy data. This causes Macie to associate the newly uploaded file with the original finding, allowing the attacker to use the "Reveal Sample" feature to extract the previously detected secret. This issue poses a significant security risk, as secrets that were assumed to be deleted remain retrievable through this method.

flow

Steps To Reproduce:

  1. Upload a file (e.g., test-secret.txt) to an S3 bucket with sensitive data, such as an AWS secret key. Wait for AWS Macie to scan and generate a finding.

  2. Navigate to AWS Macie Findings, locate the generated finding, and use the Reveal Sample feature to view the detected secret.

  3. Delete test-secret.txt from the S3 bucket and verify that it no longer exists.

  4. Create a new file named test-secret.txt with dummy data and re-upload it to the same S3 bucket using attacker's account.

  5. Return to AWS Macie Findings, access the original finding, and click Reveal Sample again.

  6. Observe that Macie still reveals the original secret, despite the file being deleted and replaced with different content from different accounts, in our case it will be the attacker's account.

Summary:

This vulnerability allows an attacker with sufficient AWS IAM permissions to recover previously detected secrets even after the original file has been deleted from S3. If an AWS secret key, access token, or other sensitive credential is exposed, an attacker could leverage this flaw to retrieve it and gain unauthorized access to AWS resources. This could lead to privilege escalation, unauthorized data access, or further compromise of cloud assets, resulting in data breaches and service disruptions.