AWS IAM Privilege Escalation – Methods and Mitigation

Spencer Gietzen

Intro: AWS Privilege Escalation Vulnerabilities

At Rhino Security Labs, we do a lot of penetration testing for AWS architecture and invest heavily in related AWS security research. This post will cover our recent findings in new IAM Privilege Escalation methods – 21 in total – which allow an attacker to escalate from a compromised low-privilege account to full administrative privileges.

In addition to many new privilege escalation routes, we’ve created a scanning tool (available on Github) to identify these vulnerabilities in your own AWS user account. If you have an account with IAM read access for all users, the script can be run against every user in the account to detect these vulnerabilities account-wide.

Note: This is a longer, more meaty blog post. For those just looking for the remediation steps and scanner….

• AWS Privilege Escalation Scanner (aws_escalate.py) + Github
• Mitigation Suggestions
• AWS Exploitation (and Pacu Beta)

Why is this Important?

Cloud privilege escalation and IAM permission misconfigurations have been discussed in the past, but most posts and tools only offer ‘best practices’ and not context on what’s actually exploitable.

By documenting specific combinations of weak permissions that could lead to compromise, we aim to help highlight these risks and bring awareness to ways API permissions can be abused.

Specific AWS Escalation Methods

Here we get into the full list of identified escalation methods, as well as a description and potential impact for each.

Specific credit to Asaf Hecht and the team at CyberArk for their initial research into “AWS Shadow Admins”. Their aggregation of AWS IAM privilege escalation research is included here and helped drive forward this idea and the discovery of new methods.

1. Creating a new policy version

Description: An attacker with the iam:CreatePolicyVersion permission can create a new version of an IAM policy that they have access to. This allows them to define their own custom permissions.

Potential Impact: This privilege escalation method could allow a user to gain full administrator access of the AWS account.

Example command:

aws iam create-policy-version –policy-arn target_policy_arn –policy-document file://path/to/administrator/policy.json –set-as-default

2. Setting the default policy version to an existing version

Description: An attacker with the iam:SetDefaultPolicyVersion permission may be able to escalate privileges through existing policy versions that are not currently in use.

Potential Impact: This could range from no privilege escalation at all to gaining full administrator access to the AWS account.

Example command:

aws iam set-default-policy-version –policy-arn target_policy_arn –version-id v2

3. Creating an EC2 instance with an existing instance profile

Description: An attacker with the iam:PassRole and ec2:RunInstances permissions can create a new EC2 instance that they will have operating system access to.

Potential Impact: This attack would give an attacker access to the set of permissions that the instance profile/role has.

Example command:

aws ec2 run-instances –image-id ami-a4dc46db –instance-type t2.micro –iam-instance-profile Name=iam-full-access-ip –key-name my_ssh_key

4. Creating a new user access key

Description: An attacker with the iam:CreateAccessKey permission on other users can create an access key ID and secret access key belonging to another user.

Potential Impact: This method would give an attacker the same level of permissions as any user they were able to create an access key for.

Example command:

aws iam create-access-key –user-name target_user

5. Creating a new login profile

Description: An attacker with the iam:CreateLoginProfile permission on other users can create a password to use to login to the AWS console.

Potential Impact: This method would give an attacker the same level of permissions as any user they were able to create a login profile for.

Example command:

aws iam create-login-profile –user-name target_user –password ‘some_random_password’ –no-password-reset-required

6. Updating an existing login profile

Description: An attacker with the iam:UpdateLoginProfile permission can change the password used to login to the AWS console.

Potential Impact: Could allow an attacker the same level of permissions as any user they were able to update the login profile for.

Example command:

aws iam update-login-profile –user-name target_user –password ‘some_random_password’ –no-password-reset-required

7. Attaching a policy to a user

Description: An attacker with the iam:AttachUserPolicy permission can escalate privileges by attaching a policy to a user.

Potential Impact: This could give the attacker full administrator access to the AWS environment.

Example command:

aws iam attach-user-policy –user-name my_username –policy-arn arn:aws:iam::aws:policy/AdministratorAccess

8. Attaching a policy to a group

Description: An attacker with the iam:AttachGroupPolicy permission can escalate privileges by attaching a policy to a group.

Potential Impact: This could give the attacker full administrator access to the AWS environment.

Example command:

aws iam attach-group-policy –group-name group_i_am_in –policy-arn arn:aws:iam::aws:policy/AdministratorAccess

9. Attaching a policy to a role

Description: An attacker with the iam:AttachRolePolicy permission can escalate privileges by attaching a policy to a role that they have access to.

Potential Impact: This could give the attacker full administrator access to the AWS environment.

Example command:

aws iam attach-role-policy –role-name role_i_can_assume –policy-arn arn:aws:iam::aws:policy/AdministratorAccess

10. Creating/updating an inline policy for a user

Description: An attacker with the iam:PutUserPolicy permission can escalate privileges by creating or updating an inline policy for a user.

Potential Impact: An attacker could escalate to full administrator privileges in the AWS environment.

Example command:

aws iam put-user-policy –user-name my_username –policy-name my_inline_policy –policy-document file://path/to/administrator/policy.json

11. Adding a user to a group

Description: An attacker with the iam:AddUserToGroup permission can use it to add themselves to an existing IAM Group.

Potential Impact: Could range from no privilege escalation to full administrator access to the account.

Example command:

aws iam add-user-to-group –group-name target_group –user-name my_username

12. Passing a role to a new Lambda function, then invoking it

Description: A user with the iam:PassRole and lambda:CreateFunction permissions can escalate privileges by passing a role to a new Lambda function.

Potential Impact: This would give a user access to the privileges associated with any Lambda service role.

Example commands:

aws lambda create-function –function-name my_function –runtime python3.6 –role arn_of_lambda_role –handler lambda_function.lambda_handler –code file://my/python/code.py aws lambda invoke –function-name my_function output.txt

Scanning for Permission Flaws: aws_escalate

While any of these privilege escalation methods can be checked manually, we have written a tool to do all that checking for you: aws_escalate.py.

Using the script, it is possible to detect what users have access to what privilege escalation methods in an AWS environment. It can be run against any user or every user in the account if the access keys being used have IAM read access.

Defense and Mitigation

In general, defending against these attacks is relatively simple. The key recommendation is to fully utilize the “Resource” option of IAM policies and make use of built-in variables that policies support.

A policy that restricts actions to the current user might look like:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "iam:CreateAccessKey",
        "iam:CreateLoginProfile",
        "iam:UpdateLoginProfile"
      ],
      "Resource": "arn:aws:iam::123456789012:user/${aws:username}"
    }
  ]
}

By using IAM policies correctly, the security of an AWS environment can be significantly improved.