Summary
AWS added an excessive s3:getObject permission to AWSSupportServiceRolePolicy
IAM policy used by AWS Support teams, and removed it a day later.
Affected Services
N/A
Remediation
None required, though best practice would be to use KMS-CMK for bucket
encryption and minimize privileges in resource policies.
Tracked CVEs
No tracked CVEs
References
https://aws.amazon.com/security/security-bulletins/AWS-2021-007/https://twitter.com/0xdabbad00/status/1473448889948598275
Contributed by https://github.com/z0ph
Disclosure Date
Tue, Dec 21st, 2021
Exploitablity Period
-
Known ITW Exploitation
-
Detection Methods
-
Piercing Index Rating
-
Discovered by
Scott Piper, Summit Route
