Two serious security vulnerabilities were recently found in AWS services, but because they were responsibly reported and the cloud biz responded quick

Orca Security tells AWS fail tale with a happy ending

submited by
Style Pass
2022-01-13 23:30:04

Two serious security vulnerabilities were recently found in AWS services, but because they were responsibly reported and the cloud biz responded quickly, no harm appears to have been done.

On Thursday, Orca Security published details about Superglue and BreakingFormation, vulnerabilities in AWS Glue and AWS Cloud Formation that allowed attackers to access data for other customers and to access files and make server-side requests to internal web services infrastructure.

AWS Glue is a serverless data integration service for preparing data for subsequent processing. But thanks to an internal misconfiguration, Orca Security researchers were able to obtain more information than should have been allowed.

"During our research, we were able to identify a feature in AWS Glue that could be exploited to obtain credentials to a role within the AWS service’s own account, which provided us full access to the internal service API," explained Yanir Tsarimi in a blog post.

"In combination with an internal misconfiguration in the Glue internal service API, we were able to further escalate privileges within the account to the point where we had unrestricted access to all resources for the service in the region, including full administrative privileges."

Leave a Comment