Sponsor shoutout

A security ticket with no context is where a fix goes to die. Plerion's agents investigate the finding, trace it to the repo that owns it, and open a pull request your engineers can review and merge. See the platform or get a free assessment.

Training on Enemy Ground: Cross-Tenant RCE in Amazon SageMaker

by Dan Gansel

Remember all that awesome shadow resources research? Turns out there's more juice to squeeze. SageMaker Python SDK's default_bucket() helper, used in over 200 of AWS's own example notebooks, writes to sagemaker-{region}-{account_id}. AWS added a bucket ownership check back in 2023, but it only ran when the bucket showed up in your own bucket list, which a squatted bucket never does (duh). With the bucket squatted, an attacker can swap processing scripts before the container pulls them, or plant code in an endpoint's serving bundle. Lots of fun details here.

Athena's Trojan Horse: Cross-Tenant Data Poisoning and Exfiltration via AWS Athena

by Dan Gansel

More bucket squatting from Dan. aws-sdk-pandas, AWS's official pandas library for Athena and friends, sends query results to a default bucket called aws-athena-query-results-{account_id}-{region} if you don't name one. AWS already fixed this exact squatting target in the Athena service, but the SDK builds the same name on its own. When it tries to create the bucket, it treats "someone else owns this" like "you must already own this" and writes your results to the existing bucket. Dan also wrote up a related aws-sdk-pandas issue with EMR logs.

Things LLMs get wrong about AWS IAM

by Alex Smolen

Alex reviews a lot of IAM policies written by coding agents, and they keep making the same mistakes. Agents love adding a Deny next to an Allow to "lock things down", which often adds complexity without improving security much. Apparently they also try to sprinkle permissions boundaries around as defence in depth. I'd be interested to see what mistakes other people see. His Van Halen test is seeing an explicit Allow for sts:GetCallerIdentity, an action that never needed an Allow and can't be blocked anyway. Maybe it's worth pointing your LLM at it before starting on any IAM writing tasks.