SEC Consult Vulnerability Lab Security Advisory < 20240411-0 > ======================================================================= title: Database Passwords in Server Response product: Amazon AWS Glue vulnerable version: until 2024-02-23 fixed version: as of 2024-02-23 CVE number: - impact: medium homepage: https://aws.amazon.com/glue/ found: 2023-05-10 by: Michael Werner (Eviden) SEC Consult Vulnerability Lab An integrated part of SEC Consult, an Eviden business Europe | Asia https://www.sec-consult.com ======================================================================= Vendor description: ------------------- "AWS Glue is a serverless data integration service that makes it easier to discover, prepare, move, and integrate data from multiple sources for analytics, machine learning (ML), and application development." Source: https://aws.amazon.com/glue/ Business recommendation: ------------------------ The vendor has fixed the issue in the currently available version on all instances world-wide as of 2024-02-23. Vulnerability overview/description: ----------------------------------- 1) Database Passwords in Server Response The password of database connections in AWS Glue is loaded into the website when a connection's edit page is requested. Principals with appropriate permissions can read the password. This behavior also increases the risk that database passwords will be intercepted by an attacker during transmission in the server response. Many types of vulnerabilities, such as broken access controls, cross-site scripting and weaknesses in session handling, could enable an attacker to leverage this behavior to retrieve the passwords. Proof of concept: ----------------- 1) Database Passwords in Server Response The following steps are necessary to reconstruct the vulnerability: 1. Login to the AWS Console and switch to the Glue module. 2. Go to "Data connections" and create a new connection. 3. Choose a connection type that allows username / password authentication (e.g. JDBC). <image ref: aws_glue_connection_config.webp> 4. Open the new connection's "Edit" page and inspect the password field e.g. with the browser's DevTools. <image ref: aws_glue_poc.webp> The following permissions were used: * glue:GetConnections (for the list view of connections; not necessary to open the connection page itself if the connection name is known) * glue:GetConnection (for opening the connection page) * ec2:DescribeSubnets (for opening the edit page of a connection) Permission Summary: A principal only needs the permissions glue:GetConnection and ec2:DescribeSubnets to retrieve the database password of a connection. The attacker also needs either knowledge of the connection's name to open the edit page directly (e.g. https://us-east-1.console.aws.amazon.com/gluestudio/home?region=us-east-1#/connection/edit-connection/Security%20Advisory/) or the permission glue:GetConnections to list existing connections. Vulnerable / tested versions: ----------------------------- The version that was current at 2023-05-10 has been tested and found to be vulnerable. Vendor contact timeline: ------------------------ 2023-06-07: Contacting vendor through [email protected] 2023-06-07: Vendor response, provides PGP key, sending encrypted security advisory. 2023-06-08: Vendor response, team is investigating the report, asking about public disclosure timeline. 2023-06-16: Vendor is still working on the report, will inform us on a weekly basis. 2023-07-24: Vendor requires additional time, next update will be early September, provides weekly updates. 2023-09-14: Vendor team is working on rolling out a fix. 2023-09-21: Vendor encountered roll-out issues, full mass deployment now scheduled to be finished in 2023Q4. 2023-10-05: Vendor hit "first milestone" in their development, 3-staged approach. 2023-10-25: Vendor hit second milestone before full rollout. 2024-02-14: Asking for a status update. 2024-02-15: Vendor is still working on the issue. Asking them for a timeline. 2024-02-23: Vendor reports that fix is implemented and deployed worldwide. Coordinating public release. 2024-02-28: Sending details where we publish the advisory, asking for a CVE number. 2024-03-01: Vendor asks whether we meant CVE or CVSS. 2024-04-08: Clarifying that we mean CVE, but CVE not needed for cloud. Setting release date to 11th April. 2024-04-11: Coordinated release of security advisory. Solution: --------- The vendor has fixed the issue and deployed the patch worldwide as of as of 2024-02-23. Workaround: ----------- None Advisory URL: ------------- https://sec-consult.com/vulnerability-lab/ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SEC Consult Vulnerability Lab An integrated part of SEC Consult, an Eviden business Europe | Asia About SEC Consult Vulnerability Lab The SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an Eviden business. It ensures the continued knowledge gain of SEC Consult in the field of network and application security to stay ahead of the attacker. The SEC Consult Vulnerability Lab supports high-quality penetration testing and the evaluation of new offensive and defensive technologies for our customers. Hence our customers obtain the most current information about vulnerabilities and valid recommendation about the risk profile of new technologies. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Interested to work with the experts of SEC Consult? Send us your application https://sec-consult.com/career/ Interested in improving your cyber security with the experts of SEC Consult? Contact our local offices https://sec-consult.com/contact/ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Mail: security-research at sec-consult dot com Web: https://www.sec-consult.com Blog: https://blog.sec-consult.com Twitter: https://twitter.com/sec_consult EOF Michael Werner / @2024