AWS MWAA Execution Role Account Wildcard Vulnerability

Reading time: 3 minutes

Udhaifu

Execution role ya MWAA (IAM role ambayo Airflow workers hutumia kufikia rasilimali za AWS) inahitaji sera hii ya lazima ili ifanye kazi:

{
"Effect": "Allow",
"Action": [
"sqs:ChangeMessageVisibility",
"sqs:DeleteMessage",
"sqs:GetQueueAttributes",
"sqs:GetQueueUrl",
"sqs:ReceiveMessage",
"sqs:SendMessage"
],
"Resource": "arn:aws:sqs:us-east-1:*:airflow-celery-*"
}

The wildcard (*) in the account ID position allows the role to interact with any SQS queue in any AWS account that starts with airflow-celery-. This is required because AWS provisions MWAA's internal queues in a separate AWS-managed account. There is no restriction on making queues with the airflow-celery- prefix.

Haiwezi kutatuliwa: Kuondoa wildcard kabla ya deployment kunaharibu MWAA kabisa - scheduler hawawezi kuweka tasks kwenye queue za workers.

Documentation Verifying Vuln and Acknowledging Vectorr: AWS Documentation

Exploitation

All Airflow DAGs run with the execution role's permissions. DAGs are Python scripts that can execute arbitrary code - they can use yum or curl to install tools, download malicious scripts, or import any Python library. DAGs are pulled from an assigned S3 folder and run on schedule automatically, all an attacker needs is ability to PUT to that bucket path.

Mtu yeyote anayeweza kuandika DAGs (kawaida watumiaji wengi katika mazingira ya MWAA) anaweza kutumia vibaya ruhusa hii:

1. Data Exfiltration: Unda queue iitwayo airflow-celery-exfil katika account ya nje, andika DAG inayotuma data nyeti kwake kupitia boto3

2. Command & Control: Kusoma maamri (poll) kutoka queue ya nje, kuyatekeleza, kurudisha matokeo - kuunda backdoor ya kudumu kupitia SQS APIs

3. Cross-Account Attacks: Suka ujumbe wenye madhara katika queues za mashirika mengine ikiwa zinafuata muundo wa majina

Shambulio zote zinapita kando ya udhibiti wa mtandao kwa sababu zinatumia AWS APIs, si miunganisho ya moja kwa moja ya internet.

Impact

Hii ni dosari ya usanifu katika MWAA bila nafuu inayotegemea IAM. Kila deployment ya MWAA inayofuata nyaraka za AWS ina udhaifu huu.

Network Control Bypass: Shambulio hizi zinafanya kazi hata katika VPCs za kibinafsi bila upatikanaji wa internet. SQS API calls zinatumia mtandao wa ndani wa AWS na VPC endpoints, zikivuka kwa ukamilifu udhibiti wa kawaida wa usalama wa mtandao, firewalls, na egress monitoring. Mashirika hayawezi kugundua au kuzuia njia hii ya data exfiltration kupitia udhibiti wa ngazi ya mtandao.