aws-quicksight-ssrf-datasource-cred
quicksight:CreateDataSource (relational types) with an attacker-controlled endpoint causes QuickSight to transmit credentials to that host on connection test/ingestion - SSRF-style credential exfiltration.
match (effective permission)
{
"action": "quicksight:CreateDataSource",
"resource_type": "AWS::QuickSight::DataSource"
}
where
data source type is a relational/JDBC type that uses CredentialPair: MYSQL, POSTGRESQL, SQLSERVER, ORACLE, AURORA, AURORA_POSTGRESQL, MARIADB, SPARK, JIRA, SERVICENOW (not GITHUB; GitHub uses OAuth, not TCP credential handshake)
principal can supply an arbitrary host/port in DataSourceParameters (no endpoint allow-list enforced)
?new_datasource is the newly-created
GenericData node with provider_type AWS::QuickSight::DataSource
emit
| source type | Data |
|---|---|
| target type | Credential |
| source | ?new_datasource |
| target | <credential provided to / stored by the new data source> |
| permissions | quicksight:CreateDataSource |
| conditions | iam_permission network_reachability |
| state logic | ACTIVE when the principal has quicksight:CreateDataSource, the data source is in CREATION_SUCCESSFUL state, and can supply an arbitrary endpoint (no IAM condition or QuickSight VPC-connection restriction limits the endpoint). CONDITIONAL(network_reachability) when QuickSight is restricted to a VPC connection that limits reachable hosts (attacker endpoint must be in-VPC). BLOCKED if a Service Control Policy or QuickSight account setting restricts data source creation or endpoint ranges. |
Narrative
QuickSight data source {datasource.name} (type {datasource.type}) stores {credential_type} credentials and connects to an attacker-controlled endpoint. QuickSight will send the configured credentials to that endpoint when testing the connection or refreshing the dataset, exfiltrating them to the attacker.
Raw rule rules/derived/aws/quicksight.yaml
id: aws-quicksight-ssrf-datasource-cred
emits: ExposesCredential
description: "quicksight:CreateDataSource (relational types) with an attacker-controlled endpoint causes\
\ QuickSight to transmit credentials to that host on connection test/ingestion \u2014 SSRF-style credential\
\ exfiltration."
match_effective_permission:
action: quicksight:CreateDataSource
resource_type: AWS::QuickSight::DataSource
where:
- 'data source type is a relational/JDBC type that uses CredentialPair: MYSQL, POSTGRESQL, SQLSERVER,
ORACLE, AURORA, AURORA_POSTGRESQL, MARIADB, SPARK, JIRA, SERVICENOW (not GITHUB; GitHub uses OAuth,
not TCP credential handshake)'
- principal can supply an arbitrary host/port in DataSourceParameters (no endpoint allow-list enforced)
- ?new_datasource is the newly-created GenericData node with provider_type AWS::QuickSight::DataSource
emit:
source_type: Data
target_type: Credential
source: ?new_datasource
target: <credential provided to / stored by the new data source>
permissions:
- quicksight:CreateDataSource
conditions:
- iam_permission
- network_reachability
state_logic: ACTIVE when the principal has quicksight:CreateDataSource, the data source is in CREATION_SUCCESSFUL
state, and can supply an arbitrary endpoint (no IAM condition or QuickSight VPC-connection restriction
limits the endpoint). CONDITIONAL(network_reachability) when QuickSight is restricted to a VPC connection
that limits reachable hosts (attacker endpoint must be in-VPC). BLOCKED if a Service Control Policy
or QuickSight account setting restricts data source creation or endpoint ranges.
confidence: min(contributing_confidences) * 0.80
derived_from: []
false_positive_note: "This only applies to JDBC/relational data source types where QuickSight actively\
\ opens a TCP connection to the endpoint and sends credentials. S3, Athena, Redshift via IAM, OpenSearch,\
\ and other AWS-IAM data source types do NOT use stored CredentialPair credentials \u2014 QuickSight\
\ uses its service role; no credential exfiltration to an attacker endpoint is possible for those\
\ types. SaaS types using API keys (not TCP credential handshake) such as JIRA and SERVICENOW leak\
\ tokens differently (API replay rather than TCP auth). Also requires that the QuickSight account\
\ does not enforce a VPC connection allow-list that constrains reachable hosts. The attacker must\
\ be able to receive the inbound connection from QuickSight's IP range (NAT gateway / internet-facing\
\ endpoint)."
narrative: QuickSight data source {datasource.name} (type {datasource.type}) stores {credential_type}
credentials and connects to an attacker-controlled endpoint. QuickSight will send the configured credentials
to that endpoint when testing the connection or refreshing the dataset, exfiltrating them to the attacker.