Skip to main content

Insufficient data authenticity validation - Cloudtrail Logs

Description​

One or more Cloudtrail instances do not enable the EnableLogFileValidation attribute avoiding the integrity validation to be performed. This practice could aid an attacker to inject malicious information in log files without rainsing any alert.

Impact​

Alterate the system logs integrity witouth raising alerts.

Recommendation​

Set the EnableLogFileValidation attribute in true for all Cloudtrail instances.

Threat​

Authenticated attacker from the Internet.

Expected Remediation Time​

⌚ 15 minutes.

Score​

Default score using CVSS 3.1. It may change depending on the context of the vulnerability.

Base​

  • Attack vector: N
  • Attack complexity: H
  • Privileges required: L
  • User interaction: N
  • Scope: U
  • Confidentiality: N
  • Integrity: L
  • Availability: N

Temporal​

  • Exploit code madurity: P
  • Remediation level: O
  • Report confidence: C

Result​

  • Vector string: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C
  • Score:
    • Base: 3.1
    • Temporal: 2.8
  • Severity:
    • Base: Low
    • Temporal: Low

Code Examples​

Compliant code​

The resource correctly enables log file validation

Resources:
  trail1:
    Type: AWS::CloudTrail::Trail
    Properties:
      IsLogging: true
      S3BucketName: bk1
      EnableLogFileValidation: true
resource "aws_cloudtrail" "foobar" {
  enable_log_file_validation    = true
  name                          = "tf-trail-foobar"
  s3_bucket_name                = aws_s3_bucket.foo.id
  s3_key_prefix                 = "prefix"
  include_global_service_events = false
}

Non compliant code​

The resource does not enable log file validation

Resources:
  trail1:
    Type: AWS::CloudTrail::Trail
    Properties:
      IsLogging: true
      S3BucketName: bk2
      EnableLogFileValidation: false
resource "aws_cloudtrail" "foobar" {
  enable_log_file_validation    = false
  name                          = "tf-trail-foobar"
  s3_bucket_name                = aws_s3_bucket.foo.id
  s3_key_prefix                 = "prefix"
  include_global_service_events = false
}

Using the AWS CLI, the following command checks CloudTrail trails have file integrity validation feature enabled

$ aws cloudtrail describe-trails

The command returns the following output

{
  "trailList": [
    {
      "IncludeGlobalServiceEvents": true,
      "Name": "MyGlobalTrail",
      "TrailARN": "arn:aws:cloudtrail:us-east-1:
                  123456789012:trail/MyGlobalTrail",
      "LogFileValidationEnabled": false,
      "IsMultiRegionTrail": false,
      "S3BucketName": "cloudtrail-global-logging",
      "HomeRegion": "us-east-1"
    }
  ]
}

If LogFileValidationEnabled config parameter value is set to false, the trail has an insecure configuration

Requirements​

free trial

Search for vulnerabilities in your apps for free with our automated security testing! Start your 21-day free trial and discover the benefits of our Continuous Hacking Machine Plan. If you prefer a full service that includes the expertise of our ethical hackers, don't hesitate to contact us for our Continuous Hacking Squad Plan.