SEC Consult Vulnerability Lab Security Advisory < 20240411-0 >
=======================================================================
               title: Database Passwords in Server Response
             product: Amazon AWS Glue
  vulnerable version: until 2024-02-23
       fixed version: as of 2024-02-23
          CVE number: -
              impact: medium
            homepage: https://aws.amazon.com/glue/
               found: 2023-05-10
                  by: Michael Werner (Eviden)
                      SEC Consult Vulnerability Lab
                      An integrated part of SEC Consult, an Eviden business
                      Europe | Asia
                      https://www.sec-consult.com
=======================================================================
Vendor description:
-------------------
"AWS Glue is a serverless data integration service that makes it easier to
discover, prepare, move, and integrate data from multiple sources for
analytics, machine learning (ML), and application development."
Source: https://aws.amazon.com/glue/
Business recommendation:
------------------------
The vendor has fixed the issue in the currently available version
on all instances world-wide as of 2024-02-23.
Vulnerability overview/description:
-----------------------------------
1) Database Passwords in Server Response
The password of database connections in AWS Glue is loaded into the
website when a connection's edit page is requested. Principals with
appropriate permissions can read the password. This behavior also
increases the risk that database passwords will be intercepted by an
attacker during transmission in the server response. Many types of
vulnerabilities, such as broken access controls, cross-site scripting
and weaknesses in session handling, could enable an attacker to
leverage this behavior to retrieve the passwords.
Proof of concept:
-----------------
1) Database Passwords in Server Response
The following steps are necessary to reconstruct the vulnerability:
     1. Login to the AWS Console and switch to the Glue module.
     2. Go to "Data connections" and create a new connection.
     3. Choose a connection type that allows username / password
        authentication (e.g. JDBC).
        <image ref: aws_glue_connection_config.webp>
     4. Open the new connection's "Edit" page and inspect the password
        field e.g. with the browser's DevTools.
        <image ref: aws_glue_poc.webp>
The following permissions were used:
* glue:GetConnections (for the list view of connections; not necessary
   to open the connection page itself if the connection name is known)
* glue:GetConnection (for opening the connection page)
* ec2:DescribeSubnets (for opening the edit page of a connection)
Permission Summary:
A principal only needs the permissions glue:GetConnection and ec2:DescribeSubnets
to retrieve the database password of a connection. The attacker also
needs either knowledge of the connection's name to open the edit page
directly (e.g. https://us-east-1.console.aws.amazon.com/gluestudio/home?region=us-east-1#/connection/edit-connection/Security%20Advisory/)
or the permission glue:GetConnections to list existing connections.
Vulnerable / tested versions:
-----------------------------
The version that was current at 2023-05-10 has been tested and found to be
vulnerable.
Vendor contact timeline:
------------------------
2023-06-07: Contacting vendor through [email protected]
2023-06-07: Vendor response, provides PGP key, sending encrypted
             security advisory.
2023-06-08: Vendor response, team is investigating the report, asking
             about public disclosure timeline.
2023-06-16: Vendor is still working on the report, will inform us on a
             weekly basis.
2023-07-24: Vendor requires additional time, next update will be early
             September, provides weekly updates.
2023-09-14: Vendor team is working on rolling out a fix.
2023-09-21: Vendor encountered roll-out issues, full mass deployment now
             scheduled to be finished in 2023Q4.
2023-10-05: Vendor hit "first milestone" in their development, 3-staged
             approach.
2023-10-25: Vendor hit second milestone before full rollout.
2024-02-14: Asking for a status update.
2024-02-15: Vendor is still working on the issue.
             Asking them for a timeline.
2024-02-23: Vendor reports that fix is implemented and deployed worldwide.
             Coordinating public release.
2024-02-28: Sending details where we publish the advisory, asking for a
             CVE number.
2024-03-01: Vendor asks whether we meant CVE or CVSS.
2024-04-08: Clarifying that we mean CVE, but CVE not needed for cloud.
             Setting release date to 11th April.
2024-04-11: Coordinated release of security advisory.
Solution:
---------
The vendor has fixed the issue and deployed the patch worldwide as of
as of 2024-02-23.
Workaround:
-----------
None
Advisory URL:
-------------
https://sec-consult.com/vulnerability-lab/
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
SEC Consult Vulnerability Lab
An integrated part of SEC Consult, an Eviden business
Europe | Asia
About SEC Consult Vulnerability Lab
The SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an
Eviden business. It ensures the continued knowledge gain of SEC Consult in the
field of network and application security to stay ahead of the attacker. The
SEC Consult Vulnerability Lab supports high-quality penetration testing and
the evaluation of new offensive and defensive technologies for our customers.
Hence our customers obtain the most current information about vulnerabilities
and valid recommendation about the risk profile of new technologies.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Interested to work with the experts of SEC Consult?
Send us your application https://sec-consult.com/career/
Interested in improving your cyber security with the experts of SEC Consult?
Contact our local offices https://sec-consult.com/contact/
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Mail: security-research at sec-consult dot com
Web: https://www.sec-consult.com
Blog: https://blog.sec-consult.com
Twitter: https://twitter.com/sec_consult
EOF Michael Werner / @2024