low

AWS AppStream Cloudtrail Bypass

Published Mon, Sep 11th, 2023

Platforms

aws

Summary

Credentials can be extracted from AppStream. When used, they obscure the sourceIP and userName of the initial user. The sourceIP appears as appstream.amazonaws.com.

Affected Services

AppStream

Remediation

None required

Tracked CVEs

No tracked CVEs

References

https://saransh-rana.gitbook.io/aboutme/bypass-cloudtrail-detection-using-aws-appstream

Contributed by https://github.com/ramimac

Entry Status

Finalized

Disclosure Date

Mon, Sep 11th, 2023

Exploitability Period

ongoing

Known ITW Exploitation

-

Detection Methods

None

Piercing Index Rating

-

Discovered by

Saransh Rana, CRED

More vulnerabilities...

critical

Power Platform Privilege Escalation in Azure AD

azure

Secureworks researchers discovered an Azure AD application with an abandoned reply URL related to Microsoft Power Platform. An attacker could leverage this URL to redirect authorization codes, exch...

Secureworks Counter Threat ...
high

Power Platform Custom Code information disclosure

azure

A vulnerability in Power Platform could lead to unauthorized access to Custom Code functions used for custom connectors, thereby allowing cross-tenant information disclosure of secrets or other sen...

Evan Grant, Tenable
low

Bad.Build

gcp

An information disclosure vulnerability in the Google Cloud Build service could have allowed an attacker to view sensitive logs if they had gained prior access to a GCP environment and had permissi...

Roi Nisimi, Orca Security
View all