aws-keyspaces-alter-enable-pitr-then-restore

cassandra:Alter on a source table to enable PITR, then cassandra:Restore + cassandra:Create + cassandra:Select on the target keyspace permits PITR exfiltration even when PITR is initially disabled. This is a two-step escalation path (POTENTIAL state).

derived aws emits CanReadData

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} HasPermission {'source_table': None} {'principal': None} HasPermission {'keyspace': None}

where

node_type(?source_table) == NoSQLDatabase ?source_table.provider_type == 'AWS::Cassandra::Table' ?source_table.pointInTimeRecovery.status != 'ENABLED' effective_action(?principal, ?source_table) includes 'cassandra:Alter' effective_action(?principal, ?source_table) includes 'cassandra:Restore' node_type(?keyspace) == NoSQLDatabase ?keyspace.provider_type == 'AWS::Cassandra::Keyspace' effective_action(?principal, ?keyspace) includes 'cassandra:Create' effective_action(?principal, ?keyspace) includes 'cassandra:Select'

emit

source type	`Identity`
target type	`NoSQLDatabase`
source	`?principal`
target	`?source_table`
permissions	`cassandra:Alter` `cassandra:Restore` `cassandra:Create` `cassandra:Select`
conditions	`iam_permission`
state logic	POTENTIAL when the principal holds cassandra:Alter (to enable PITR on the source table), cassandra:Restore on the source table, cassandra:Create on the target keyspace, AND cassandra:Select on the target keyspace, but the source table currently has pointInTimeRecovery.status != ENABLED. The attacker must first execute cassandra:Alter to enable PITR, then cassandra:Restore to create the exfiltration copy, then read it via cassandra:Select. This is a prerequisite chain and is emitted as POTENTIAL (may be activated if PITR is enabled via Alter in a subsequent step).

Narrative

{principal.name} can enable point-in-time recovery on {source_table.name} (cassandra:Alter), then restore to a new table and read it (cassandra:Restore + cassandra:Create + cassandra:Select on keyspace), exfiltrating all table data even though PITR was initially disabled. This is a two-step path requiring Alter to be executed first.

Raw rule rules/derived/aws/keyspaces.yaml

id: aws-keyspaces-alter-enable-pitr-then-restore
emits: CanReadData
description: cassandra:Alter on a source table to enable PITR, then cassandra:Restore + cassandra:Create
  + cassandra:Select on the target keyspace permits PITR exfiltration even when PITR is initially disabled.
  This is a two-step escalation path (POTENTIAL state).
match:
- - principal: null
  - HasPermission
  - source_table: null
- - principal: null
  - HasPermission
  - keyspace: null
where:
- node_type(?source_table) == NoSQLDatabase
- ?source_table.provider_type == 'AWS::Cassandra::Table'
- ?source_table.pointInTimeRecovery.status != 'ENABLED'
- effective_action(?principal, ?source_table) includes 'cassandra:Alter'
- effective_action(?principal, ?source_table) includes 'cassandra:Restore'
- node_type(?keyspace) == NoSQLDatabase
- ?keyspace.provider_type == 'AWS::Cassandra::Keyspace'
- effective_action(?principal, ?keyspace) includes 'cassandra:Create'
- effective_action(?principal, ?keyspace) includes 'cassandra:Select'
emit:
  source_type: Identity
  target_type: NoSQLDatabase
  source: ?principal
  target: ?source_table
  permissions:
  - cassandra:Alter
  - cassandra:Restore
  - cassandra:Create
  - cassandra:Select
  conditions:
  - iam_permission
  state_logic: POTENTIAL when the principal holds cassandra:Alter (to enable PITR on the source table),
    cassandra:Restore on the source table, cassandra:Create on the target keyspace, AND cassandra:Select
    on the target keyspace, but the source table currently has pointInTimeRecovery.status != ENABLED.
    The attacker must first execute cassandra:Alter to enable PITR, then cassandra:Restore to create the
    exfiltration copy, then read it via cassandra:Select. This is a prerequisite chain and is emitted
    as POTENTIAL (may be activated if PITR is enabled via Alter in a subsequent step).
  confidence: contributing_confidence * 0.80
  derived_from:
  - <HasPermission edge for cassandra:Alter on ?source_table>
  - <HasPermission edge for cassandra:Restore on ?source_table>
  - <HasPermission edge for cassandra:Create on ?keyspace>
  - <HasPermission edge for cassandra:Select on ?keyspace>
  false_positive_note: "This rule only fires when pointInTimeRecovery.status is NOT ENABLED (or is explicitly\
    \ DISABLED). When PITR is enabled, use the aws-keyspaces-restore-exfiltrate rule (ACTIVE state) instead.\
    \ cassandra:Alter must be effective on the source table ARN; keyspace-level Alter grants do not apply\
    \ to individual table modifications in all Keyspaces versions \u2014 verify the resource scope of\
    \ the Alter permission. cassandra:Create and cassandra:Select on the keyspace ARN are sufficient (keyspace-level\
    \ grants cover all tables)."
  narrative: '{principal.name} can enable point-in-time recovery on {source_table.name} (cassandra:Alter),
    then restore to a new table and read it (cassandra:Restore + cassandra:Create + cassandra:Select on
    keyspace), exfiltrating all table data even though PITR was initially disabled. This is a two-step
    path requiring Alter to be executed first.'