Within transiting three different files I was able to discover an internal AWS service and gain access to it. This file let Amiga retrieve the temporary identity and access management (IAM) credentials, including a publicKey and privateKey that she could test and confirm being connected to an internal role called csd-grover-role. conf (.) the file content points to another file csd-grover-credentials.json. The log_fdw extension enables the user to access the database engine log using a SQL interface (.) I spent some time going over system files until I found an interesting argument in the PostgreSQL config file that was not shown through using psql (.) the apg_storage_conf_file which points to another configuration file with the name grover_volume.

Gafnit Amiga, director of security research at Lightspin, writes how she obtained credentials to an internal service Grover using a PostgreSQL extension, bypassing the log_fdw extension validation: AWS confirmed the issue and deprecated dozens of minor versions of Amazon Aurora and RDS for PostgreSQL.Īccording to Amazon, database users with sufficient permissions could use these credentials to gain elevated access to resources associated with the database cluster from which they were obtained and could not be used to access internal RDS services or move between databases or AWS accounts. A researcher at the security company Lightspin recently explained how she obtained credentials to an internal AWS service using a PostgreSQL extension and exploiting a local file read vulnerability on RDS.

Aws postgresql