Database Passwords in Server Response in Amazon AWS Glue

Title

Database Passwords in Server Response

Product

Amazon AWS Glue

Vulnerable Version

until 2024-02-23

Fixed Version

as of 2024-02-23

CVE Number

-

Impact

medium

Homepage

https://aws.amazon.com/glue/

Found

05.05.2023

By

Michael Werner (Eviden) | SEC Consult Vulnerability Lab

The password of database connections in Amazon AWS Glue is loaded into the website when a connection's edit page is requested. Principals with appropriate permissions can read the password. This behavior also increases the risk that database passwords will be intercepted by an attacker during transmission in the server response. Many types of vulnerabilities, such as broken access control, cross-site scripting and weaknesses in session handling, could enable an attacker to leverage this behavior to retrieve the passwords.

Vendor description

"AWS Glue is a serverless data integration service that makes it easier to discover, prepare, move, and integrate data from multiple sources for analytics, machine learning (ML), and application development."

Source: https://aws.amazon.com/glue/

 

Business recommendation

The vendor has fixed the issue in the currently available version on all instances world-wide as of 2024-02-23.


Vulnerability overview/description

1) Database Passwords in Server Response

The password of database connections in AWS Glue is loaded into the website when a connection's edit page is requested. Principals with appropriate permissions can read the password. This behavior also increases the risk that database passwords will be intercepted by an attacker during transmission in the server response. Many types of vulnerabilities, such as broken access controls, cross-site scripting and weaknesses in session handling, could enable an attacker to leverage this behavior to retrieve the passwords.  


Proof of concept

1) Database Passwords in Server Response

The following steps are necessary to reconstruct the vulnerability:

  1. Login to the AWS Console and switch to the Glue module.
  2. Go to "Data connections" and create a new connection.
  3. Choose a connection type that allows username / password authentication (e.g. JDBC) - see figure 1.
  4. Open the new connection's "Edit" page and inspect the password field e.g. with the browser's DevTools - see figure 2.
Screenshot of AWS Glue Connection Config
Figure 1: AWS Glue Connection Config: connection type allowing username / password authentication
Screenshot of page inspection tools to show plain text password
Figure 2: Plain text password visible via browser dev tools

The following permissions were used:

  • glue:GetConnections (for the list view of connections; not necessary to open the connection page itself if the connection name is known)
  • glue:GetConnection (for opening the connection page)
  • ec2:DescribeSubnets (for opening the edit page of a connection)

Permission Summary

A principal only needs the permissions glue:GetConnection and ec2:DescribeSubnets to retrieve the database password of a connection. The attacker also needs either knowledge of the connection's name to open the edit page directly (e.g. us-east-1.console.aws.amazon.com/gluestudio/home) or the permission glue:GetConnections to list existing connections.


Vulnerable / tested versions

The version that was current at 2023-05-10 has been tested and found to be vulnerable.


Vendor contact timeline

2023-06-07 Contacting vendor through aws-security@amazon.com
2023-06-07 Vendor response, provides PGP key, sending encrypted security advisory.
2023-06-08 Vendor response, team is investigating the report, asking about public disclosure timeline.
2023-06-16 Vendor is still working on the report, will inform us on a weekly basis.
2023-07-24 Vendor requires additional time, next update will be early September, provides weekly updates.
2023-09-14 Vendor team is working on rolling out a fix.
2023-09-21 Vendor encountered roll-out issues, full mass deployment now scheduled to be finished in 2023Q4.
2023-10-05 Vendor hit "first milestone" in their development, 3-staged approach.
2023-10-25 Vendor hit second milestone before full rollout.
2024-02-14 Asking for a status update.
2024-02-15 Vendor is still working on the issue. Asking them for a timeline.
2024-02-23 Vendor reports that fix is implemented and deployed worldwide. Coordinating public release.
2024-02-28 Sending details where we publish the advisory, asking for a CVE number.
2024-03-01 Vendor asks whether we meant CVE or CVSS.
2024-04-08 Clarifying that we mean CVE, but CVE not needed for cloud. Setting release date to 11th April.
2024-04-11 Coordinated release of security advisory.

Solution

The vendor has fixed the issue and deployed the patch worldwide as of as of 2024-02-23.


Workaround

None

 

Advisory URL

https://sec-consult.com/vulnerability-lab/

EOF Michael Werner / @2024

 

Interested to work with the experts of SEC Consult? Send us your application

Interested in improving your cyber security with the experts of SEC Consult? Contact our local offices

Back