Supply Chain Vuln Compromised Core AWS GitHub Repos & Threatened the AWS Console
1–10 of 40 posts
Re: Supply Chain Vuln Compromised Core AWS GitHub Repos & Threatened the AWS Console
#2Breaking this down, several of AWS's core repos like the JS SDK use an allowlist of which contributor ids can run workflow actions in their PRs. The list was a regex, contained several short ids, and wasn't anchored with ^$, so if it allowed user 12345, then any userid containing 12345 could run their own actions on the PR, including one that exfiltrated access tokens. So they spammed GH with user creation requests, got an id that matched, and they were in like Flynn.
Said tokens didn't have admin access, but had enough privileges to invite other users to become full admins. Not sure if they were rotated, but github tokens are usually long-lived, like up to a year. Hey, isn't AWS the one always lecturing us to use temporary credentials? To be fair, AWS did more than just fix the regex, they introduced an "approve workflow run" UI unto the PR process that I think GH is also using now (not sure about that).
Re: Supply Chain Vuln Compromised Core AWS GitHub Repos & Threatened the AWS Console
#3happens to the best of us
Re: Supply Chain Vuln Compromised Core AWS GitHub Repos & Threatened the AWS Console
#4Oh no, is the AWS Console ok?
Re: Supply Chain Vuln Compromised Core AWS GitHub Repos & Threatened the AWS Console
#5Breaking this down, several of AWS's core repos like the JS SDK use an allowlist of which contributor ids can run workflow actions in their PRs. The list was a regex, contained several short ids, and wasn't anchored with ^$, so if it allowed user 12345, then any userid containing 12345 could run their own actions on the PR, including one that exfiltrated access tokens. So they spammed GH with user creation requests,…
> Said tokens didn't have admin access, but had enough privileges to invite other users to become full admins.
Ah... Github permissions. What fun.
Github actually has a way to federate with AWS for short-lived credentials, but then it screws everything up by completely half-assing the ghcr.io implementation. It's only available using the old deprecated classic access tokens.
Re: Supply Chain Vuln Compromised Core AWS GitHub Repos & Threatened the AWS Console
#6Breaking this down, several of AWS's core repos like the JS SDK use an allowlist of which contributor ids can run workflow actions in their PRs. The list was a regex, contained several short ids, and wasn't anchored with ^$, so if it allowed user 12345, then any userid containing 12345 could run their own actions on the PR, including one that exfiltrated access tokens. So they spammed GH with user creation requests,…
At least the vuln was old enough so that they couldn't blame AI for it, otherwise the article would read different ;)
Re: Supply Chain Vuln Compromised Core AWS GitHub Repos & Threatened the AWS Console
#7Breaking this down, several of AWS's core repos like the JS SDK use an allowlist of which contributor ids can run workflow actions in their PRs. The list was a regex, contained several short ids, and wasn't anchored with ^$, so if it allowed user 12345, then any userid containing 12345 could run their own actions on the PR, including one that exfiltrated access tokens. So they spammed GH with user creation requests,…
> The list was a regex ...
Regexpes for security allow lists: what could possibly every go wrong uh!?
Re: Supply Chain Vuln Compromised Core AWS GitHub Repos & Threatened the AWS Console
#8I worked on docs at GitHub which are open source, synced to an internal repo, and deployed on internal infra. I recall jumping through many hoops to make it work safely. These were workflows that had secrets access for deployments, and I recall zipping files, doing some weird handoffs/file filtering between different workflows based on the triggers and permissions. Security folks were really quick to find any gaps =)
Glad to see a few more security knobs on actions these days!
Re: Supply Chain Vuln Compromised Core AWS GitHub Repos & Threatened the AWS Console
#9Breaking this down, several of AWS's core repos like the JS SDK use an allowlist of which contributor ids can run workflow actions in their PRs. The list was a regex, contained several short ids, and wasn't anchored with ^$, so if it allowed user 12345, then any userid containing 12345 could run their own actions on the PR, including one that exfiltrated access tokens. So they spammed GH with user creation requests,…
Another success story for Regexes! Let's keep using this cryptic mess!
Re: Supply Chain Vuln Compromised Core AWS GitHub Repos & Threatened the AWS Console
#10I always wondered if their decision to limit availability of CodeCommit had something to do with the overall quality of the underlying implementation. It always came off as an "also ran" product without any real care or effort put into it. Either that or the team responsible for creating it ultimately left the company.. anyways..
This article lends some credibility to that notion.