Summary
A vulnerability in Amazon DataZone allowed potential attackers to assume roles in AWS accounts by exploiting a confused deputy problem. This could have granted unauthorized access to sensitive data managed by DataZone or other AWS services accessible by the IAM role trusting DataZone. The issue has been resolved, with no customers reportedly impacted.
Affected Services
Amazon DataZone
Remediation
Ensure AWS accounts associated with a domain are properly vetted, review and audit IAM roles and their trust relationships, and enforce least privilege access principles.
Tracked CVEs
No tracked CVEs
References
Contributed by https://github.com/korniko98
Entry Status
Stub (AI-Generated)
Disclosure Date
Thu, Aug 29th, 2024
Exploitablity Period
Until 2024/09/25
Known ITW Exploitation
-
Detection Methods
Monitor for unexpected AssumeRole events from datazone.amazonaws.com in CloudTrail logs, especially for roles not explicitly associated with your DataZone environments.
Piercing Index Rating
-
Discovered by
Carlos Mora, TrustOnCloud
