low
VPC Hosted Zones unauditable
Published Fri, May 24th, 2019
Platforms
Summary
For 6 years, it was not possible to see what hosted zones an attacker may have created in an account. This issue could be viewed as a business decision that adding the ability to viewing this data was not worthwhile, but the delay is significant and would allow someone that had compromised an environment to maintain a backdoor.
Affected Services
N/A
Remediation
Audit your VPC hosted zones
Tracked CVEs
No tracked CVEs
References
https://twitter.com/__steele/status/1273748905826455552https://blog.ryanjarv.sh/2019/05/24/backdooring-route53-with-cross-account-dns.html
Contributed by https://github.com/RyanJarv
Entry Status
Finalized
Disclosure Date
Mon, May 13th, 2019
Exploitability Period
-
Known ITW Exploitation
-
Detection Methods
None
Piercing Index Rating
-
Discovered by
Ryan Gerstenkorn
