AWS CloudTrail bypass for specific IAM actions
Published Tue, Jan 17th, 2023
Platforms
Summary
Through an undocumented API service called 'iamadmin', attackers could invoke any of 13 read-only IAM actions without the activity being being logged to CloudTrail. These actions included listing group policies (iam:ListGroupPolicies), listing access keys (iam:ListAccessKeys), retrieving information about a role (iam:GetRole), and more. This could have enabled adversaries to perform enumeration and reconnaissance activity undetected after gaining a foothold in a victim AWS environment.
Affected Services
IAM
Remediation
None required
Tracked CVEs
No tracked CVEs
References
Contributed by https://github.com/frichetten
Entry Status
Finalized
Disclosure Date
Thu, Mar 10th, 2022
Exploitability Period
Until 2022/10/24
Known ITW Exploitation
-
Detection Methods
None
Piercing Index Rating
-
Discovered by
Nick Frichette, Datadog
