Amazon Web Services Inc. has patched a flaw across seven of its software development kits after product security startup Pi Inc. traced a single bug report to roughly 2,500 instances of the same defect, Pi revealed today.
Every AWS SDK builds the hostname it calls from a template. The region drops into the middle of https://{service}.{region}.amazonaws.com. A valid region looks like us-east-1. On the vulnerable code paths, nothing checked for that.
Plenty of applications let a user pick the region, so Pi’s researchers picked “@attacker.com#”. The SDK built https://sts.@attacker.com#.amazonaws.com and signed a request to that address. A URL parser reads everything before the @ as a username. Everything after the # gets discarded. What survives is attacker.com.
Redirecting an ordinary application programming interface call leaks a request signature. That is survivable. The AssumeRoleWithWebIdentity call made by Elastic Kubernetes Service workloads, Cognito applications and…