Skip to main content

Insufficient data authenticity validation - Cloudtrail Logs

Description

One or more Cloudtrail instances do not enable the EnableLogFileValidation attribute avoiding the integrity validation to be performed. This practice could aid an attacker to inject malicious information in log files without rainsing any alert.

Impact

Alterate the system logs integrity witouth raising alerts.

Recommendation

Set the EnableLogFileValidation attribute in true for all Cloudtrail instances.

Threat

Authenticated attacker from the Internet.

Expected Remediation Time

⌚ 15 minutes.

Score

Default score using CVSS 3.1. It may change depending on the context of the vulnerability.

Base

  • Attack vector: N
  • Attack complexity: H
  • Privileges required: L
  • User interaction: N
  • Scope: U
  • Confidentiality: N
  • Integrity: L
  • Availability: N

Temporal

  • Exploit code madurity: P
  • Remediation level: O
  • Report confidence: C

Result

  • Vector string: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C
  • Score:
    • Base: 3.1
    • Temporal: 2.8
  • Severity:
    • Base: Low
    • Temporal: Low

Code Examples

Compliant code

The resource correctly enables log file validation

Resources:
trail1:
Type: AWS::CloudTrail::Trail
Properties:
IsLogging: true
S3BucketName: bk1
EnableLogFileValidation: true
resource "aws_cloudtrail" "foobar" {
enable_log_file_validation = true
name = "tf-trail-foobar"
s3_bucket_name = aws_s3_bucket.foo.id
s3_key_prefix = "prefix"
include_global_service_events = false
}

Non compliant code

The resource does not enable log file validation

Resources:
trail1:
Type: AWS::CloudTrail::Trail
Properties:
IsLogging: true
S3BucketName: bk2
EnableLogFileValidation: false
resource "aws_cloudtrail" "foobar" {
enable_log_file_validation = false
name = "tf-trail-foobar"
s3_bucket_name = aws_s3_bucket.foo.id
s3_key_prefix = "prefix"
include_global_service_events = false
}

Using the AWS CLI, the following command checks CloudTrail trails have file integrity validation feature enabled

$ aws cloudtrail describe-trails

The command returns the following output

{
"trailList": [
{
"IncludeGlobalServiceEvents": true,
"Name": "MyGlobalTrail",
"TrailARN": "arn:aws:cloudtrail:us-east-1:
123456789012:trail/MyGlobalTrail",
"LogFileValidationEnabled": false,
"IsMultiRegionTrail": false,
"S3BucketName": "cloudtrail-global-logging",
"HomeRegion": "us-east-1"
}
]
}

If LogFileValidationEnabled config parameter value is set to false, the trail has an insecure configuration

Requirements

free trial

Search for vulnerabilities in your apps for free with our automated security testing! Start your 21-day free trial and discover the benefits of our Continuous Hacking Machine Plan. If you prefer a full service that includes the expertise of our ethical hackers, don't hesitate to contact us for our Continuous Hacking Squad Plan.