low

Route table modification to imitate metadata service

Published Mon, Oct 19th, 2020

Platforms

aws

Summary

An attacker with sufficient privileges in AWS to modify the route table and some other EC2 privileges, could pretend to be a metadata server and provide an attacker controlled bootup script to EC2s to move laterally.

Affected Services

N/A

Remediation

None required

Tracked CVEs

No tracked CVEs

References

https://github.com/RyanJarv/EC2FakeImdshttps://blog.ryanjarv.sh/2020/10/19/imds-persistence.html

Contributed by https://github.com/0xdabbad00

Entry Status

Finalized

Disclosure Date

Mon, Oct 19th, 2020

Exploitability Period

-

Known ITW Exploitation

-

Detection Methods

None

Piercing Index Rating

-

Discovered by

Ryan Gerstenkorn

More vulnerabilities...

low

Enumeration of Privileges Without Being Logged to CloudTrail

aws

An attacker who gained access to IAM credentials could enumerate a subset of the privileges they had access to without logging to CloudTrail. This would allow them to perform the typically noisy pe...

Nick Frichette
medium

AI Hub Jupyter Notebook instance CSRF

gcp

AI Hub Jupyter Notebook server lacked a check of the Origin header that led to a CSRF vulnerability. An attacker could have read sensitive data and execute arbitrary actions in customer environments.

s1r1us
low

Lack of internal change controls for IAM managed policies

aws

AWS have released or changed managed IAM policies in unexpected and insecure ways. Examples include: CheesepuffsServiceRolePolicy, AWSServiceRoleForThorInternalDevPolicy, AWSCodeArtifactReadOnlyAcc...

Anonymous discoverer
View all