Article by Nick Frichette.

Steal IAM Credentials and Event Data from Lambda

Technique seen in the wild

Reference: Compromised Cloud Compute Credentials: Case Studies From the Wild

In Lambda, IAM credentials are passed into the function via environment variables. The benefit for the adversary is that these credentials can be leaked via file read vulnerabilities such as XML External Entity attacks or SSRF that allows the file protocol. This is because "everything is a file".

IAM credentials can be accessed via reading /proc/self/environ.

Note

In the event that /proc/self/environ is blocked by a WAF, check if you can read the environment variables of other processes. This can be done by reading /proc/#/environ where '#' is some number often between 1 and 20.

In addition to IAM credentials, Lambda functions also have event data that is passed to the function when it is started. This data is made available to the function via the runtime interface. Unlike IAM credentials, this data is accessible over standard SSRF at http://localhost:9001/2018-06-01/runtime/invocation/next.

This will include information about what invoked the Lambda function and may be valuable depending on the context.

Note

Unlike IAM credentials associated with EC2 instances, there is no GuardDuty alert for stolen Lambda credentials.