Skip to main content

Automatic information enumeration - AWS

Description

The system exposes resources that are not necessary for the operation of the application.

Impact

Expose system resources that can be enumerated.

Recommendation

The application should not expose resources that are not explicitly necessary for the operation of the application, exposing unnecessary resources could expand the attack surface.

Threat

Anonymous attacker from the Internet.

Expected Remediation Time

⌚ 60 minutes.

Score

Default score using CVSS 3.1. It may change depending on the context of the vulnerability.

Base

  • Attack vector: A
  • Attack complexity: L
  • Privileges required: N
  • User interaction: N
  • Scope: U
  • Confidentiality: L
  • Integrity: N
  • Availability: N

Temporal

  • Exploit code madurity: P
  • Remediation level: X
  • Report confidence: X

Result

  • Vector string: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:X
  • Score:
    • Base: 4.3
    • Temporal: 4.1
  • Severity:
    • Base: Medium
    • Temporal: Medium

Code Examples

Compliant code

The access for each passrole whould have the resources defined with given specific roles

{
"Effect": "Allow",
"Action": "iam:PassRole",
"Resource": [
"arn:aws:::123456789012:role/admin"
"arn:aws:::123456789012:role/user"
]
}

Non compliant code

There is a wildcard passrole that could potentially expose all resources

{
"Effect": "Allow",
"Action": "iam:PassRole",
"Resource": [
"*"
]
}

Requirements