A cloud secret storage misconfiguration
- Exposed secret
- 1
- S3 buckets compromised
- 3
A cloud pentest found administrator credentials exposed in a CloudFormation stack’s outputs, opening the way to buckets of sensitive personal data.
The Problem
A company approached Aphotic for a cloud pentest, as much of their environment was natively based in AWS and handled sensitive personally identifiable information (PII). As such, it was particularly important to ensure that this environment was secure.
The Finding
Aphotic discovered that a cloud administrator had automated the process of credential rotation and provisioning through a CloudFormation script. This is not uncommon in cloud environments, as it is easier to automate the rotation of credentials compared to on-premises deployments, thanks to seamless integration between cloud functions and convenient solutions such as AWS Secrets Manager.
However, on further investigation into the CloudFormation stack, Aphotic discovered that the credentials for the users it created were exposed as stack outputs. These included the credentials for an account with the AdministratorAccess AWS managed policy.
As a result, any AWS user with permission to read information from the CloudFormation service could obtain the secrets. Aphotic was able to leverage this to gain administrator privileges and compromise several S3 buckets in the account that contained sensitive PII.
The Fix
The fix was simple: move the provisioning of secrets into a Secrets Manager stack, and make the stack output the secret’s ARN rather than its value. Users and services could then be given IAM permissions to read the secret by its ARN, and those permissions could be provisioned through similar automation.