Cognito, Ergo Some Extra Permissions
Exploiting AWS Cognito misconfigurations to achieve privilege escalation and account takeover.
Summary
Leo Tsaousis, Senior Security Consultant at WithSecure, analyzes a critical cloud security vulnerability in Amazon Cognito that allowed unauthenticated attackers to gain unauthorized permissions into AWS accounts through publicly shared CloudWatch dashboards [00:06]. Tsaousis recounts discovering that public dashboard URLs exposed underlying Amazon Cognito identity pools, creating an unauthenticated entry point into target environments prior to AWS's July 2024 patch [04:17].
The presentation breaks down the four-step exploitation chain, showing how reverse-engineering an undocumented viewer application revealed that identity pools configured with the legacy "Allow Classic Flow" setting allowed unauthenticated callers to exchange identity IDs directly for temporary AWS STS credentials [08:35, 17:33]. Tsaousis demonstrates how unauthenticated actors could invoke unauthorized AWS APIs—such as enumerating EC2 instance tags and infrastructure metadata—solely by knowing a dashboard URL [13:00]. The talk concludes by examining AWS's service-level remediation, identifying lingering post-patch configuration hazards, and offering guidance for auditing identity pools [22:00, 26:21].
(AI summary — Gemini Flash)
Related talks
Main Stage·37 min
Yakir Kadkoda · Michael Katchinskiy · Ofek Itach
Six critical attack vectors exploiting implicit and internal shadow resources created by AWS services to achieve cross-tenant and account takeover.
Cloud Village·35 min
Michael Raggo
Michael Raggo examines toxic combinations across 24,000 cloud permissions in AWS, Azure, and GCP, mapping privilege escalation graphs.
Main Stage·39 min
Nick Frichette
Deep dive into vulnerabilities in AWS services and cloud architectures that enable attackers to gain initial access to customer workloads.