Amazon AWS Glue Database Password Disclosure

`SEC Consult Vulnerability Lab Security Advisory < 20240411-0 >  
=======================================================================  
title: Database Passwords in Server Response  
product: Amazon AWS Glue  
vulnerable version: until 2024-02-23  
fixed version: as of 2024-02-23  
CVE number: -  
impact: medium  
homepage: https://aws.amazon.com/glue/  
found: 2023-05-10  
by: Michael Werner (Eviden)  
SEC Consult Vulnerability Lab  
  
An integrated part of SEC Consult, an Eviden business  
Europe | Asia  
  
https://www.sec-consult.com  
  
=======================================================================  
  
Vendor description:  
-------------------  
"AWS Glue is a serverless data integration service that makes it easier to  
discover, prepare, move, and integrate data from multiple sources for  
analytics, machine learning (ML), and application development."  
  
Source: https://aws.amazon.com/glue/  
  
  
Business recommendation:  
------------------------  
The vendor has fixed the issue in the currently available version  
on all instances world-wide as of 2024-02-23.  
  
  
Vulnerability overview/description:  
-----------------------------------  
1) Database Passwords in Server Response  
The password of database connections in AWS Glue is loaded into the  
website when a connection's edit page is requested. Principals with  
appropriate permissions can read the password. This behavior also  
increases the risk that database passwords will be intercepted by an  
attacker during transmission in the server response. Many types of  
vulnerabilities, such as broken access controls, cross-site scripting  
and weaknesses in session handling, could enable an attacker to  
leverage this behavior to retrieve the passwords.  
  
  
Proof of concept:  
-----------------  
1) Database Passwords in Server Response  
The following steps are necessary to reconstruct the vulnerability:  
1. Login to the AWS Console and switch to the Glue module.  
2. Go to "Data connections" and create a new connection.  
3. Choose a connection type that allows username / password  
authentication (e.g. JDBC).  
<image ref: aws_glue_connection_config.webp>  
4. Open the new connection's "Edit" page and inspect the password  
field e.g. with the browser's DevTools.  
<image ref: aws_glue_poc.webp>  
  
  
The following permissions were used:  
* glue:GetConnections (for the list view of connections; not necessary  
to open the connection page itself if the connection name is known)  
* glue:GetConnection (for opening the connection page)  
* ec2:DescribeSubnets (for opening the edit page of a connection)  
  
Permission Summary:  
A principal only needs the permissions glue:GetConnection and ec2:DescribeSubnets  
to retrieve the database password of a connection. The attacker also  
needs either knowledge of the connection's name to open the edit page  
directly (e.g. https://us-east-1.console.aws.amazon.com/gluestudio/home?region=us-east-1#/connection/edit-connection/Security%20Advisory/)  
or the permission glue:GetConnections to list existing connections.  
  
  
Vulnerable / tested versions:  
-----------------------------  
The version that was current at 2023-05-10 has been tested and found to be  
vulnerable.  
  
  
Vendor contact timeline:  
------------------------  
2023-06-07: Contacting vendor through [email protected]  
2023-06-07: Vendor response, provides PGP key, sending encrypted  
security advisory.  
2023-06-08: Vendor response, team is investigating the report, asking  
about public disclosure timeline.  
2023-06-16: Vendor is still working on the report, will inform us on a  
weekly basis.  
2023-07-24: Vendor requires additional time, next update will be early  
September, provides weekly updates.  
2023-09-14: Vendor team is working on rolling out a fix.  
2023-09-21: Vendor encountered roll-out issues, full mass deployment now  
scheduled to be finished in 2023Q4.  
2023-10-05: Vendor hit "first milestone" in their development, 3-staged  
approach.  
2023-10-25: Vendor hit second milestone before full rollout.  
2024-02-14: Asking for a status update.  
2024-02-15: Vendor is still working on the issue.  
Asking them for a timeline.  
2024-02-23: Vendor reports that fix is implemented and deployed worldwide.  
Coordinating public release.  
2024-02-28: Sending details where we publish the advisory, asking for a  
CVE number.  
2024-03-01: Vendor asks whether we meant CVE or CVSS.  
2024-04-08: Clarifying that we mean CVE, but CVE not needed for cloud.  
Setting release date to 11th April.  
2024-04-11: Coordinated release of security advisory.  
  
  
Solution:  
---------  
The vendor has fixed the issue and deployed the patch worldwide as of  
as of 2024-02-23.  
  
  
Workaround:  
-----------  
None  
  
  
Advisory URL:  
-------------  
https://sec-consult.com/vulnerability-lab/  
  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
SEC Consult Vulnerability Lab  
An integrated part of SEC Consult, an Eviden business  
Europe | Asia  
  
About SEC Consult Vulnerability Lab  
The SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an  
Eviden business. It ensures the continued knowledge gain of SEC Consult in the  
field of network and application security to stay ahead of the attacker. The  
SEC Consult Vulnerability Lab supports high-quality penetration testing and  
the evaluation of new offensive and defensive technologies for our customers.  
Hence our customers obtain the most current information about vulnerabilities  
and valid recommendation about the risk profile of new technologies.  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
Interested to work with the experts of SEC Consult?  
Send us your application https://sec-consult.com/career/  
  
Interested in improving your cyber security with the experts of SEC Consult?  
Contact our local offices https://sec-consult.com/contact/  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Mail: security-research at sec-consult dot com  
Web: https://www.sec-consult.com  
Blog: https://blog.sec-consult.com  
Twitter: https://twitter.com/sec_consult  
  
EOF Michael Werner / @2024  
`