AWS - Codestar Privesc
Codestar
Unaweza kupata habari zaidi kuhusu codestar katika:
codestar:CreateProject, codestar:AssociateTeamMemberiam:PassRole
, codestar:CreateProject
iam:PassRole
, codestar:CreateProject
Kwa idhini hizi unaweza kutumia jukumu la IAM la codestar kufanya vitendo vya kupindukia kupitia template ya cloudformation. Angalia ukurasa ufuatao:
iam:PassRole, codestar:CreateProjectcodestar:CreateProject
, codestar:AssociateTeamMember
codestar:CreateProject
, codestar:AssociateTeamMember
Mbinu hii inatumia codestar:CreateProject
kuunda mradi wa codestar, na codestar:AssociateTeamMember
kumfanya mtumiaji wa IAM awe mmiliki wa mradi mpya wa CodeStar, ambao utawapa sera mpya na idhini chache ziada.
If you are already a member of the project you can use the permission codestar:UpdateTeamMember
to update your role to owner instead of codestar:AssociateTeamMember
Athari Inayowezekana: Privesc kwa sera ya codestar iliyoundwa. Unaweza kupata mfano wa sera hiyo katika:
codestar:CreateProject, codestar:AssociateTeamMembercodestar:CreateProjectFromTemplate
codestar:CreateProjectFromTemplate
Tengeneza Mradi Mpya:
Tumia hatua ya
codestar:CreateProjectFromTemplate
kuanzisha uundaji wa mradi mpya.Baada ya uundaji mafanikio, ufikiaji unatolewa moja kwa moja kwa
cloudformation:UpdateStack
.Ufikiaji huu unalenga hasa stakli inayohusiana na jukumu la IAM
CodeStarWorker-<jina la mradi la kawaida>-CloudFormation
.
Sasisha Stakli ya Lengo:
Kwa ruhusa zilizotolewa za CloudFormation, endelea kusasisha stakli iliyotajwa.
Jina la stakli kawaida litafuata mojawapo ya mifano miwili:
awscodestar-<jina la mradi la kawaida>-miundombinu
awscodestar-<jina la mradi la kawaida>-lambda
Jina kamili linategemea templeti iliyochaguliwa (kurejelea skripti ya kudanganya mfano).
Ufikiaji na Ruhusa:
Baada ya kusasisha, unapata uwezo uliopewa jukumu la IAM la CloudFormation linalohusishwa na stakli.
Kumbuka: Hii haipati moja kwa moja ruhusa kamili za msimamizi. Rasilimali zilizopangwa vibaya zaidi ndani ya mazingira zinaweza kuhitajika kuinua ruhusa zaidi.
Kwa habari zaidi angalia utafiti wa asili: https://rhinosecuritylabs.com/aws/escalating-aws-iam-privileges-undocumented-codestar-api/. Unaweza kupata udanganyifu huo katika https://github.com/RhinoSecurityLabs/Cloud-Security-Research/blob/master/AWS/codestar_createprojectfromtemplate_privesc/CodeStarPrivEsc.py
Athari Inayowezekana: Privesc kwa jukumu la IAM la cloudformation.
Last updated