exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Amazon AWS Glue Database Password Disclosure

Amazon AWS Glue Database Password Disclosure
Posted Apr 15, 2024
Authored by Michael Werner | Site sec-consult.com

The password of database connections in AWS Glue is loaded into the website when a connection's edit page is requested. Principals with appropriate permissions can read the password. This behavior also increases the risk that database passwords will be intercepted by an attacker during transmission in the server response. Many types of vulnerabilities, such as broken access controls, cross site scripting and weaknesses in session handling, could enable an attacker to leverage this behavior to retrieve the passwords.

tags | exploit, vulnerability, xss
SHA-256 | 70e6691798348933f72079d525b978bc0517e5c1f2d9ac8b96813c23d1234685

Amazon AWS Glue Database Password Disclosure

Change Mirror Download
SEC Consult Vulnerability Lab Security Advisory < 20240411-0 >
=======================================================================
title: Database Passwords in Server Response
product: Amazon AWS Glue
vulnerable version: until 2024-02-23
fixed version: as of 2024-02-23
CVE number: -
impact: medium
homepage: https://aws.amazon.com/glue/
found: 2023-05-10
by: Michael Werner (Eviden)
SEC Consult Vulnerability Lab

An integrated part of SEC Consult, an Eviden business
Europe | Asia

https://www.sec-consult.com

=======================================================================

Vendor description:
-------------------
"AWS Glue is a serverless data integration service that makes it easier to
discover, prepare, move, and integrate data from multiple sources for
analytics, machine learning (ML), and application development."

Source: https://aws.amazon.com/glue/


Business recommendation:
------------------------
The vendor has fixed the issue in the currently available version
on all instances world-wide as of 2024-02-23.


Vulnerability overview/description:
-----------------------------------
1) Database Passwords in Server Response
The password of database connections in AWS Glue is loaded into the
website when a connection's edit page is requested. Principals with
appropriate permissions can read the password. This behavior also
increases the risk that database passwords will be intercepted by an
attacker during transmission in the server response. Many types of
vulnerabilities, such as broken access controls, cross-site scripting
and weaknesses in session handling, could enable an attacker to
leverage this behavior to retrieve the passwords.


Proof of concept:
-----------------
1) Database Passwords in Server Response
The following steps are necessary to reconstruct the vulnerability:
1. Login to the AWS Console and switch to the Glue module.
2. Go to "Data connections" and create a new connection.
3. Choose a connection type that allows username / password
authentication (e.g. JDBC).
<image ref: aws_glue_connection_config.webp>
4. Open the new connection's "Edit" page and inspect the password
field e.g. with the browser's DevTools.
<image ref: aws_glue_poc.webp>


The following permissions were used:
* glue:GetConnections (for the list view of connections; not necessary
to open the connection page itself if the connection name is known)
* glue:GetConnection (for opening the connection page)
* ec2:DescribeSubnets (for opening the edit page of a connection)

Permission Summary:
A principal only needs the permissions glue:GetConnection and ec2:DescribeSubnets
to retrieve the database password of a connection. The attacker also
needs either knowledge of the connection's name to open the edit page
directly (e.g. https://us-east-1.console.aws.amazon.com/gluestudio/home?region=us-east-1#/connection/edit-connection/Security%20Advisory/)
or the permission glue:GetConnections to list existing connections.


Vulnerable / tested versions:
-----------------------------
The version that was current at 2023-05-10 has been tested and found to be
vulnerable.


Vendor contact timeline:
------------------------
2023-06-07: Contacting vendor through aws-security@amazon.com
2023-06-07: Vendor response, provides PGP key, sending encrypted
security advisory.
2023-06-08: Vendor response, team is investigating the report, asking
about public disclosure timeline.
2023-06-16: Vendor is still working on the report, will inform us on a
weekly basis.
2023-07-24: Vendor requires additional time, next update will be early
September, provides weekly updates.
2023-09-14: Vendor team is working on rolling out a fix.
2023-09-21: Vendor encountered roll-out issues, full mass deployment now
scheduled to be finished in 2023Q4.
2023-10-05: Vendor hit "first milestone" in their development, 3-staged
approach.
2023-10-25: Vendor hit second milestone before full rollout.
2024-02-14: Asking for a status update.
2024-02-15: Vendor is still working on the issue.
Asking them for a timeline.
2024-02-23: Vendor reports that fix is implemented and deployed worldwide.
Coordinating public release.
2024-02-28: Sending details where we publish the advisory, asking for a
CVE number.
2024-03-01: Vendor asks whether we meant CVE or CVSS.
2024-04-08: Clarifying that we mean CVE, but CVE not needed for cloud.
Setting release date to 11th April.
2024-04-11: Coordinated release of security advisory.


Solution:
---------
The vendor has fixed the issue and deployed the patch worldwide as of
as of 2024-02-23.


Workaround:
-----------
None


Advisory URL:
-------------
https://sec-consult.com/vulnerability-lab/


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

SEC Consult Vulnerability Lab
An integrated part of SEC Consult, an Eviden business
Europe | Asia

About SEC Consult Vulnerability Lab
The SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an
Eviden business. It ensures the continued knowledge gain of SEC Consult in the
field of network and application security to stay ahead of the attacker. The
SEC Consult Vulnerability Lab supports high-quality penetration testing and
the evaluation of new offensive and defensive technologies for our customers.
Hence our customers obtain the most current information about vulnerabilities
and valid recommendation about the risk profile of new technologies.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Interested to work with the experts of SEC Consult?
Send us your application https://sec-consult.com/career/

Interested in improving your cyber security with the experts of SEC Consult?
Contact our local offices https://sec-consult.com/contact/
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Mail: security-research at sec-consult dot com
Web: https://www.sec-consult.com
Blog: https://blog.sec-consult.com
Twitter: https://twitter.com/sec_consult

EOF Michael Werner / @2024
Login or Register to add favorites

File Archive:

May 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    44 Files
  • 2
    May 2nd
    5 Files
  • 3
    May 3rd
    11 Files
  • 4
    May 4th
    0 Files
  • 5
    May 5th
    0 Files
  • 6
    May 6th
    28 Files
  • 7
    May 7th
    3 Files
  • 8
    May 8th
    4 Files
  • 9
    May 9th
    54 Files
  • 10
    May 10th
    12 Files
  • 11
    May 11th
    0 Files
  • 12
    May 12th
    0 Files
  • 13
    May 13th
    17 Files
  • 14
    May 14th
    11 Files
  • 15
    May 15th
    17 Files
  • 16
    May 16th
    13 Files
  • 17
    May 17th
    22 Files
  • 18
    May 18th
    0 Files
  • 19
    May 19th
    0 Files
  • 20
    May 20th
    17 Files
  • 21
    May 21st
    18 Files
  • 22
    May 22nd
    7 Files
  • 23
    May 23rd
    111 Files
  • 24
    May 24th
    0 Files
  • 25
    May 25th
    0 Files
  • 26
    May 26th
    0 Files
  • 27
    May 27th
    0 Files
  • 28
    May 28th
    0 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close