GHSA-q4pp-j36h-3gqg Minimal `basti` IAM Policy Allows Shell Access

Not scored Published 24 Aug 2023

The minimal IAM policy for basti allows users to obtain shell access on the bastion host instead of just port forwarding, leading to privilege escalation.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is GHSA-q4pp-j36h-3gqg?

GHSA-q4pp-j36h-3gqg is a missing authorization vulnerability in basti-cdk, published on 24 Aug 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Summary

The provided Minimal IAM Policy for bastic connect does not include ssm:SessionDocumentAccessCheck. This results in the ability to get a shell session on the bastion, not just the intended access for Port Forwarding.

Details

basti connect is designed to "securely connect to your RDS/Aurora/Elasticache/EC2 instances", using a bastion instance "with AWS Session Manager port forwarding capability to make the target available on your localhost."

The Minimal IAM Policy allows port forwarding via the following statement:

 {
      &#34;Effect&#34;: &#34;Allow&#34;,
      &#34;Action&#34;: &#34;ssm:StartSession&#34;,
      &#34;Resource&#34;: [
        &#34;arn:aws:ssm:*:*:document/AWS-StartPortForwardingSessionToRemoteHost&#34;,
        &#34;arn:aws:ec2:&lt;your-region&gt;:&lt;your-account-id&gt;:instance/&lt;your-basti-instance-id&gt;&#34;
      ]
    }

This statement does not include the following condition:

&#34;Condition&#34;: {
    &#34;BoolIfExists&#34;: {
        &#34;ssm:SessionDocumentAccessCheck&#34;: &#34;true&#34;
    }
}

As a result, the basti connect minimal policy is logically identical to:

 {
      &#34;Effect&#34;: &#34;Allow&#34;,
      &#34;Action&#34;: &#34;ssm:StartSession&#34;,
      &#34;Resource&#34;: [
        &#34;arn:aws:ssm:*:*:document/AWS-StartPortForwardingSessionToRemoteHost&#34;,
        &#34;arn:aws:ssm:*:*:document/SSM-SessionManagerRunShell&#34;,
        &#34;arn:aws:ec2:&lt;your-region&gt;:&lt;your-account-id&gt;:instance/&lt;your-basti-instance-id&gt;&#34;
      ]
    }

A basti admin would expect users under the minimal policy to be able to port forward. However, they could also get a shell on the bastion.

For more details on this footgun, see: https://ramimac.me/ssm-iam

PoC

Complete instructions, including specific configuration details, to reproduce the vulnerability.

Impact

Impact would depend on configuration/hardening of the bastion. I've seen examples where bastions have credentials to downstream systems in configuration or memory that would be exposed.

Which versions are affected by GHSA-q4pp-j36h-3gqg?

2 open source packages ship an affected version, including basti-cdk.

Package	Affected	Fixed in
`basti-cdk` npm	All versions	`1.0.1`
`basti-cdk` npm	All versions	`1.0.1`

How do I fix GHSA-q4pp-j36h-3gqg?

Upgrade basti-cdk to 1.0.1 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is GHSA-q4pp-j36h-3gqg being exploited?

There is no known exploitation of GHSA-q4pp-j36h-3gqg in the wild and no public exploit code.