GHSA-3ggq-wrf4-c88v: LoadLogic/LoadZilla IAM Privilege Escalation Vulnerability

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Description: - Vulnerability Name: Potential risk in the LoadLogic and LoadZilla which can lead to privilege escalation - Publisher: zolaer9527 - Vulnerability ID: GHSA-3ggq-wrf4-c88v - Release Date: 4 days ago 2. Affected Versions: - LoadLogic: <1.4.3 - LoadZilla: <4.0.4 3. Fixed Versions: - LoadLogic: 1.4.3 - LoadZilla: 4.0.4 4. Severity: - Severity Level: High - CVSS v3 Base Metrics: - Attack Vector: Local - Attack Complexity: High - Privileges Required: High - User Interaction: None - Scope: Changed - Confidentiality: High - Integrity: High - Availability: High - CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/H/I:H/A:H 5. Impact: - The LoadLogic and LoadZilla applications create two functions: LogicLoadEc2DeployLambda and CredsGenFunction. These functions provide access to sts:AssumeRole and IAM operations without further restrictions. As a result, malicious users can exploit these permissions to escalate their privileges. 6. Workaround: - As a temporary mitigation, permission boundaries can be added to the roles created by LoadLogic and LoadZilla in the management account. These permission boundaries should deny all IAM and STS operations. Additionally, specific resource names should be used instead of “” to limit the scope of affected permissions. 7. References: - AWS IAM Documentation: https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html 8. Contributors**: - Special thanks to the individuals who discovered this issue: - Xunqi Liu (xungiliu@stu.xidian.edu.cn) - Nanzi Yang (nzyang@stu.xidian.edu.cn) - Jinku Li (jkl@xidian.edu.cn) - Xingyu Liu (xingyu@stu.xidian.edu.cn) This information provides a detailed description of the vulnerability, its impact, and recommended remediation steps.

Goal Reached Thanks to every supporter — we hit 100%!

GHSA-3ggq-wrf4-c88v: LoadLogic/LoadZilla IAM Privilege Escalation Vulnerability

More from this source