Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

End of Bibblio RCM includes -->
11/10/2021
09:30 AM
Connect Directly
Twitter
RSS
E-Mail

Researcher Details Vulnerabilities Found in AWS API Gateway

AWS fixed the security flaws that left the API service at risk of so-called HTTP header-smuggling attacks, says the researcher who discovered them.

BLACK HAT EUROPE 2021 — London — All it took was a space between characters and a few random letters, and Web researcher Daniel Thatcher was able to modify the HTTP header sent to Amazon API Gateway.

AWS API Gateway is a popular managed service for developers to write, manage, and secure their application programming interfaces (APIs) in a Web environment. At this week's Black Hat Europe, Thatcher, researcher and penetration tester at Intruder, demonstrated how he found flaws in the service that allowed him to bypass the API Gateway's IP address restrictions and wage a cache-poisoning attack using so-called HTTP header-smuggling.

Header-smuggling is a technique in which an attacker dupes a front-end server into sneaking malicious or phony information to the back-end server within the HTTP header, for example. HTTP (and HTTPS) headers carry information such as the client's browser, cookies, and IP address, as well as the requested Web page.

Thatcher told Dark Reading he was able to easily modify the HTTP header merely by typing a space in the header name and then some random letters. Specifically, he added "X-Forwarded-For abcd: z" to the header for HTTP requests, which bypassed the AWS IP address restriction policies in AWS API Gateway.

"The front-end server tries to strip out" invalid headers, but it can't see the modified header, so it slips to the back-end server, he explains.

While the IP address restrictions bypass "hack" using HTTP header-smuggling were relatively simple to execute, he says it would be hard for an attacker to exploit because they would need to have some knowledge or insight into a target's whitelisted IP addresses. AWS quickly fixed the IP restriction bypass flaw after he reported it, Thatcher says.

But Thatcher later found a second hole in AWS API Gateway that allowed him to use HTTP header-smuggling to sneak phony headers to the back end and employ a cache poisoning attack on the server, which he explains could let an attacker create their own API and return malicious content. The attacker then could overwrite entries in the victim's server cache and wrest control of the content of the API. AWS has since fixed the second vulnerability, Thatcher says.

As of this posting, AWS had not responded to a request for comment about the API Gateway vulnerabilities and fixes.

Free Hacking Tool
Thatcher today also will release a free, open source tool for testing Web servers for weaknesses that could allow an attacker to pull off an HTTP header-smuggling attack. The tool, which Thatcher built using researcher James Kettle's Param Miner Burp Suite toolkit, looks for header mutations that could leave the door open for HTTP header-smuggling. It provides a way for researchers to smuggle various headers through to the back-end server.

Besides scanning for HTTP header-smuggling weaknesses, other ways to protect against this attack include ensuring front-end servers can't forward unconventionally formatted headers like Thatcher was able to do, and ensuring the back-end server is more particular about the HTTP requests it accepts.

Thatcher's research likely only scratches the surface of how header smuggling can root out Web vulnerabilities, he warns. Other vulnerabilities are likely to be found.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
//Comments
Newest First  |  Oldest First  |  Threaded View
Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Machine Learning, AI & Deep Learning Improve Cybersecurity
Machine intelligence is influencing all aspects of cybersecurity. Organizations are implementing AI-based security to analyze event data using ML models that identify attack patterns and increase automation. Before security teams can take advantage of AI and ML tools, they need to know what is possible. This report covers: -How to assess the vendor's AI/ML claims -Defining success criteria for AI/ML implementations -Challenges when implementing AI
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-42003
PUBLISHED: 2022-10-02
In FasterXML jackson-databind before 2.14.0-rc1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled.
CVE-2022-42004
PUBLISHED: 2022-10-02
In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization.
CVE-2022-42002
PUBLISHED: 2022-10-01
SonicJS through 0.6.0 allows file overwrite. It has the following mutations that are used for updating files: fileCreate and fileUpdate. Both of these mutations can be called without any authentication to overwrite any files on a SonicJS application, leading to Arbitrary File Write and Delete.
CVE-2022-39268
PUBLISHED: 2022-09-30
### Impact In a CSRF attack, an innocent end user is tricked by an attacker into submitting a web request that they did not intend. This may cause actions to be performed on the website that can include inadvertent client or server data leakage, change of session state, or manipulation of an end use...
CVE-2022-34428
PUBLISHED: 2022-09-30
Dell Hybrid Client prior to version 1.8 contains a Regular Expression Denial of Service Vulnerability in the UI. An adversary with WMS group admin access could potentially exploit this vulnerability, leading to temporary denial-of-service.