Описание
Overly permissive file permissions in AWS CLI before 1.44.78 (v1) and 2.34.29 (v2) on Unix-like systems where the umask has not been configured to restrict file permissions (the default on most systems) may allow other local users on the same host to read credentials written by certain CLI subcommands (aws codeartifact login, aws iam create-virtual-mfa-device, aws deploy register).
To remediate this issue, users should upgrade to AWS CLI 1.44.78 (v1) or 2.34.29 (v2) or later.
A flaw was found in AWS CLI. Overly permissive file permissions on Unix-like systems, where the umask has not been configured to restrict file permissions, may allow other local users on the same host to read credentials. This occurs when certain AWS CLI subcommands, such as aws codeartifact login, aws iam create-virtual-mfa-device, or aws deploy register, write credentials. This vulnerability can lead to information disclosure, potentially exposing sensitive user credentials to unauthorized local attackers.
Отчет
Successful exploitation requires an attacker to already have local access to the same Unix-like host as the targeted user. Additionally, the vulnerability relies on the system having an unrestricted umask configuration and requires the victim to manually execute specific AWS CLI subcommands (such as codeartifact login or iam create-virtual-mfa-device) that write credentials to the filesystem. Impact Limitations: The direct impact is strictly limited to localized information disclosure. While the exposure of sensitive AWS credentials is a serious risk that could lead to the compromise of external AWS resources, the vulnerability itself does not allow an attacker to escalate privileges, achieve remote code execution, or compromise the integrity and availability of the local host system.
Меры по смягчению последствий
To mitigate this issue, configure a more restrictive umask for users who execute AWS CLI subcommands that handle credentials. Setting a umask of 0077 or 0027 will prevent other local users from reading newly created files. This can be achieved by adding umask 0077 (or umask 0027) to the user's shell profile (e.g., ~/.bashrc or ~/.profile). Users must log out and back in for the new umask to take effect. This mitigation applies to newly created files and does not affect existing files with overly permissive permissions.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | awscli2 | Fix deferred | ||
| Red Hat Enterprise Linux 9 | awscli2 | Fix deferred |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
Overly permissive file permissions in AWS CLI before 1.44.78 (v1) and 2.34.29 (v2) on Unix-like systems where the umask has not been configured to restrict file permissions (the default on most systems) may allow other local users on the same host to read credentials written by certain CLI subcommands (aws codeartifact login, aws iam create-virtual-mfa-device, aws deploy register). To remediate this issue, users should upgrade to AWS CLI 1.44.78 (v1) or 2.34.29 (v2) or later.
EPSS
5.5 Medium
CVSS3