{"id":"GHSA-q4pp-j36h-3gqg","aliases":[],"url":"https://o3.security/vulnerability/GHSA-q4pp-j36h-3gqg","summary":"Minimal `basti` IAM Policy Allows Shell Access","details":"### Summary\n\nThe provided Minimal IAM Policy for `bastic connect` does not include `ssm:SessionDocumentAccessCheck`. This results in the ability to get a shell session on the bastion, not just the intended access for Port Forwarding.\n\n### Details\n\n`basti connect` is designed to \"securely connect to your RDS/Aurora/Elasticache/EC2 instances\", using a bastion instance \"with [AWS Session Manager](https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager.html) port forwarding capability to make the target available on your localhost.\"\n\nThe [Minimal IAM Policy](https://github.com/BohdanPetryshyn/basti#minimal-iam-permissions) allows port forwarding via the following statement:\n\n```   \n {\n      \"Effect\": \"Allow\",\n      \"Action\": \"ssm:StartSession\",\n      \"Resource\": [\n        \"arn:aws:ssm:*:*:document/AWS-StartPortForwardingSessionToRemoteHost\",\n        \"arn:aws:ec2:<your-region>:<your-account-id>:instance/<your-basti-instance-id>\"\n      ]\n    }\n```\n\nThis statement does not include the following condition:\n\n```\n\"Condition\": {\n    \"BoolIfExists\": {\n        \"ssm:SessionDocumentAccessCheck\": \"true\"\n    }\n}\n```\n\nAs a result, the `basti connect` minimal policy is logically identical to:\n\n```\n {\n      \"Effect\": \"Allow\",\n      \"Action\": \"ssm:StartSession\",\n      \"Resource\": [\n        \"arn:aws:ssm:*:*:document/AWS-StartPortForwardingSessionToRemoteHost\",\n        \"arn:aws:ssm:*:*:document/SSM-SessionManagerRunShell\",\n        \"arn:aws:ec2:<your-region>:<your-account-id>:instance/<your-basti-instance-id>\"\n      ]\n    }\n```\n\nA `basti` admin would expect users under the minimal policy to be able to port forward. However, they could also get a shell on the bastion.\n\nFor more details on this footgun, see: https://ramimac.me/ssm-iam\n\n### PoC\n_Complete instructions, including specific configuration details, to reproduce the vulnerability._\n\n### Impact\n\nImpact would depend on configuration/hardening of the bastion. I've seen examples where bastions have credentials to downstream systems in configuration or memory that would be exposed. ","published":"2023-08-24T12:53:06Z","modified":"2023-08-24T12:53:06Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"basti-cdk","fixedVersion":"1.0.1"}],"fix":{"url":"https://github.com/BohdanPetryshyn/basti/commit/f6f218e7cd450e29aeb616960b7abbe8dfc87796","label":"BohdanPetryshyn/basti@f6f218e"},"references":[{"type":"WEB","url":"https://github.com/BohdanPetryshyn/basti/security/advisories/GHSA-q4pp-j36h-3gqg"},{"type":"WEB","url":"https://github.com/BohdanPetryshyn/basti/commit/f6f218e7cd450e29aeb616960b7abbe8dfc87796"},{"type":"PACKAGE","url":"https://github.com/BohdanPetryshyn/basti"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2023-08-24T12:53:06Z"}}