Lightspin Research Team Discovers Cross-Account Access Vulnerability on AWS SageMaker Jupiter Notebook Instance
Through a previously unreported vulnerability, attackers could run any code on an AWS SageMaker Jupyter Notebook Instance across accounts, access the Notebook Instance metadata endpoint, and steal the access token for the attached role
TEL AVIV, Israel, Dec. 2, 2021 /PRNewswire/ -- Lightspin, the multi-layer cloud security platform that prioritizes and remediates critical vulnerabilities across hybrid cloud and Kubernetes environments, announced today the discovery of a cross-account access vulnerability discovered in AWS's SageMaker Jupyter Notebook Instance.
Lightspin's research team found this vulnerability as part of its ongoing research into security in data science tools. The team investigated Amazon's SageMaker which is a fully managed machine learning (ML) service in AWS. Amazon SageMaker helps data scientists and developers to prepare, build, train, and deploy high-quality machine learning (ML) models quickly by bringing together a broad set of capabilities purpose-built for ML. SageMaker launched in 2017 and is used by some of the world's leading global enterprises, meaning any discovery of areas of exploitation could have widespread impact.
The research team investigated the potential vulnerabilities that could be attached to Amazon's SageMaker, and more specifically the Jupyter Notebook Instances. During their research, the team found that potential attackers had been able to run any code on an AWS SageMaker Jupyter Notebook Instance across accounts. This allowed them to access the Notebook Instance metadata endpoint and steal access tokens for the attached role. Using the access token, the attacker could have read data from S3 buckets, created VPC endpoints, and taken more potentially harmful actions that were allowed by the SageMaker execution role and the "AmazonSageMakerFullAccess" policy.
Since the discovery of this vulnerability, the Lightspin team contacted the AWS Security team to alert them of the findings. As of this writing, the vulnerability has since been remediated.
"It is nearly impossible for a company to have complete security control when a single app flaw can leave a door open to cyberattacks," said Gafnit Amiga, Director of Research at Lightspin. "We believe in advanced research of managed services in order to enhance the product's detection capabilities and to improve the resilience of the cloud providers for everyone."
For full access to the Lightspin research finding, AWS SageMaker Jupyter Notebook Instance Takeover, click here.
About Lightspin
Lightspin's next-gen cloud security posture management (CSPM) platform uses contextual cloud security to protect cloud and Kubernetes environments from build to runtime and simplifies cloud security for Security and DevOps teams. Using patent-pending advanced graph-based technology, Lightspin empowers cloud and security teams to eliminate risks and maximize productivity by proactively and automatically detecting all security risks, smartly prioritizing the most critical issues, and easily fixing them. For more information, visit https://www.lightspin.io/ or view Lightspin's video, at https://www.youtube.com/watch?v=WpYDVri-mtc.
Media contact for Lightspin:
Monica Maron
t: +1-912-771-5512
e: [email protected]
Logo: https://mma.prnewswire.com/media/1341650/Lightspin_Logo.jpg
Share this article