Unit 2: URLs, methods and redirects · Lesson 5 of 5 · 22 min

Case file: when a URL feature meets cloud credentials

Review the shop's cloud settings for the two weaknesses behind the Capital One breach: token-less metadata access and roles that can read everything.

case file

Capital One cloud breach

Capital One · 2019

An outside individual used a misconfigured web application firewall running in AWS to obtain temporary cloud credentials, then copied data from storage buckets. About 100 million people in the US and 6 million in Canada were affected.

What went wrong

The firewall could be made to request the instance metadata service on the attacker's behalf (server-side request forgery), and the role attached to it could list and read far more storage than it needed.

What would have stopped it

  • Require session tokens for instance metadata (IMDSv2) so a simple forwarded request cannot fetch credentials.
  • Scope each role to least privilege: a firewall role should not list or read data buckets.
  • Restrict where servers may connect out to, and include request forgery checks in reviews.

What defenders could have seen

  • Role credentials used from an address outside the company's environment.
  • A role that never touches data suddenly listing buckets and reading objects.
  • Web or firewall logs with requests aimed at the metadata address.

sourcescapitalone.comkrebsonsecurity.com

mission

You are
The analyst reviewing the shop's cloud servers after reading the case.
Situation
The shop runs its website, a firewall and a link preview service in the cloud. Each server can ask the cloud's metadata service for temporary credentials that belong to its role.
Goal
Find which servers allow token-less metadata requests and what their roles can do.
Hand in
A table of servers, metadata setting, role reach and the fix for each.

Any feature that fetches a URL on the server's behalf, such as a link preview, can be pointed somewhere its developers never intended. Defenders do not need to test that by hand to fix it: two settings decide how bad it can get.

Instance metadata as a key desk

01

Read the metadata setting

HttpTokens: required is IMDSv2: the server must first obtain a session token with a PUT request, which a forwarded GET cannot do.

learner@web-lab
jq -r '.[] | .name + " " + .metadata.HttpTokens' cases/cloud/instances.json
web-01 required
web-02 required
waf-01 optional
preview-01 optional
batch-01 required

you should see Two servers still accept token-less requests: waf-01 and preview-01.

02

Read what their roles can do

learner@web-lab
jq -r '.[] | select(.metadata.HttpTokens=="optional") | .name + " " + .role' cases/cloud/instances.json
waf-01 waf-role
preview-01 preview-role
jq -r '.Statement[] | select(.Resource=="*") | .Action[]' cases/cloud/roles/waf-role.json
s3:ListAllMyBuckets
s3:ListBucket
s3:GetObject

you should see The firewall's role can list every bucket and read any object. That is the Capital One pattern exactly.

03

Compare with a scoped role

learner@web-lab
cat cases/cloud/roles/web-role.json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject"
      ],
      "Resource": "arn:aws:s3:::shop-assets/*"
    }
  ]
}

you should see The web role can read one bucket's objects and nothing else. If its credentials leaked, the damage stops there.

04

Check where they can call out to

learner@web-lab
cat cases/cloud/egress.txt
tier     destination              allowed
web      api.payments.example     yes
web      any                      no
waf      any                      yes
preview  any                      yes
batch    s3.eu-west-2.amazonaws   yes
batch    any                      no

you should see The web and batch tiers may only reach named destinations. The firewall and preview tiers may reach anything.

defender tip An egress allowlist turns a leaked credential or a forged request into a blocked connection instead of a data transfer.

waf-01 settings

Today
HttpTokens: optional
role: s3:ListAllMyBuckets, s3:ListBucket, s3:GetObject on *
egress: any

One forwarded request away from every bucket.

Fixed
HttpTokens: required
role: logs:PutLogEvents on its log group
egress: logging endpoint only

Even a leaked credential can only write firewall logs.

What a defender takes away

  1. 1URL-fetching features are a path to internal services, including cloud metadata.
  2. 2Require IMDSv2 on every instance.
  3. 3A role's reach is the size of the breach when its credentials leak.
  4. 4Egress allowlists stop data leaving even when something else fails.

Questions

0 of 3 solved

Answer each one from what you find on your lab machine.