aws-vpclattice-listener-rule-hijack

id: aws-vpclattice-listener-rule-hijack
emits: CanModifyConfiguration
description: vpc-lattice:UpdateRule or vpc-lattice:UpdateListener lets a principal redirect traffic to
  an attacker-controlled target group, intercepting L7 traffic from all service consumers.
applies_to:
- aws
match:
- - principal: null
  - HasPermission
  - listener_or_rule: null
where:
- node_type(?principal) in [Identity]
- node_type(?listener_or_rule) == GenericNetwork
- ?listener_or_rule.provider_type in ['AWS::VpcLattice::Listener', 'AWS::VpcLattice::Rule']
- effective_action_on(?principal, ?listener_or_rule) contains 'vpc-lattice:UpdateRule' OR effective_action_on(?principal,
  ?listener_or_rule) contains 'vpc-lattice:UpdateListener'
emit:
  source_type: Identity
  target_type: GenericNetwork
  source: ?principal
  target: ?listener_or_rule
  permissions:
  - vpc-lattice:UpdateRule
  - vpc-lattice:UpdateListener
  conditions:
  - iam_permission
  - scp_or_org_policy
  state_logic: ACTIVE when vpc-lattice:UpdateRule or vpc-lattice:UpdateListener is confirmed effective
    on the target ARN. BLOCKED if an SCP or permission boundary denies the Update actions.
  confidence: 0.9
  derived_from:
  - ?principal HasPermission ?listener_or_rule (vpc-lattice:UpdateRule | vpc-lattice:UpdateListener)
  false_positive_note: This represents the capability to REDIRECT traffic; redirection requires specifying
    an attacker-controlled target group ARN with valid targets. An Update that changes routing behavior
    (path prefix, hostname, method) to point to a different target group is the security consequence.
    This is actionable only if the attacker can also create or control the target group (CanCreate on
    TargetGroup or existing attacker-owned target).
  narrative: '{principal.name} can update a Listener or Rule on {listener_or_rule.name} (vpc-lattice:UpdateRule
    / vpc-lattice:UpdateListener). By redirecting to an attacker-controlled target group, they would intercept
    L7 traffic from all service consumers, enabling data exfiltration or SSRF attacks.'