AWS - API Gateway Unauthenticated Enum

Tip

Učite i vežbajte AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Učite i vežbajte GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Učite i vežbajte Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Podržite HackTricks

API Invoke bypass

Prema predavanju Attack Vectors for APIs Using AWS API Gateway Lambda Authorizers - Alexandre & Leonardo, Lambda Authorizers se mogu konfigurisati koristeći IAM sintaksu kako bi dodelili dozvole za pozivanje API endpoint-a. Ovo je preuzeto from the docs:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Permission",
"Action": ["execute-api:Execution-operation"],
"Resource": [
"arn:aws:execute-api:region:account-id:api-id/stage/METHOD_HTTP_VERB/Resource-path"
]
}
]
}

The problem with this way to give permissions to invoke endpoints is that the “*” implies “anything” and there is no more regex syntax supported.

Neki primeri:

  • A rule such as arn:aws:execute-apis:sa-east-1:accid:api-id/prod/*/dashboard/* in order to give each user access to /dashboard/user/{username} will give them access to other routes such as /admin/dashboard/createAdmin for example.

Warning

Imajte na umu da “*” se ne zaustavlja pri širenju preko slash-eva, stoga, ako koristite “*” u api-id na primer, to takođe može označavati “bilo koji stage” ili “bilo koju metodu” sve dok je konačni regex i dalje važeći.
Tako arn:aws:execute-apis:sa-east-1:accid:*/prod/GET/dashboard/*
Može validirati POST zahtev za test stage na putanji /prod/GET/dashboard/admin, na primer.

Uvek treba jasno znati šta želite dozvoliti i zatim proveriti da li su sa dodeljenim dozvolama mogući i drugi scenariji.

For more info, apart of the docs, you can find code to implement authorizers in this official aws github.

IAM Policy Injection

In the same talk it’s exposed the fact that if the code is using user input to generate the IAM policies, wildcards (and others such as “.” or specific strings) can be included in there with the goal of bypassing restrictions.

Šablon javnog URL-a

https://{random_id}.execute-api.{region}.amazonaws.com/{user_provided}

Dobijanje ID naloga sa javnog API Gateway URL-a

Baš kao i kod S3 buckets, Data Exchange i Lambda URL gateways, moguće je pronaći ID naloga zloupotrebom aws:ResourceAccount Policy Condition Key sa javnog API Gateway URL-a. Ovo se radi tako što se ID naloga pronalazi po jedan karakter istovremeno zloupotrebom wildcards u aws:ResourceAccount sekciji policy-ja.
Ova tehnika takođe omogućava dobijanje vrednosti tagova ako znate ključ taga (postoje neki podrazumevani koji su interesantni).

Više informacija možete naći u original research i u alatu conditional-love za automatizaciju ove eksploatacije.

Tip

Učite i vežbajte AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Učite i vežbajte GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Učite i vežbajte Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Podržite HackTricks