{"id":"GHSA-q4pp-j36h-3gqg","summary":"Minimal `basti` IAM Policy Allows Shell Access","details":"### Summary\n\nThe provided Minimal IAM Policy for `bastic connect` does not include `ssm:SessionDocumentAccessCheck`. This results in the ability to get a shell session on the bastion, not just the intended access for Port Forwarding.\n\n### Details\n\n`basti connect` is designed to \"securely connect to your RDS/Aurora/Elasticache/EC2 instances\", using a bastion instance \"with [AWS Session Manager](https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager.html) port forwarding capability to make the target available on your localhost.\"\n\nThe [Minimal IAM Policy](https://github.com/BohdanPetryshyn/basti#minimal-iam-permissions) allows port forwarding via the following statement:\n\n```   \n {\n      \"Effect\": \"Allow\",\n      \"Action\": \"ssm:StartSession\",\n      \"Resource\": [\n        \"arn:aws:ssm:*:*:document/AWS-StartPortForwardingSessionToRemoteHost\",\n        \"arn:aws:ec2:\u003cyour-region\u003e:\u003cyour-account-id\u003e:instance/\u003cyour-basti-instance-id\u003e\"\n      ]\n    }\n```\n\nThis statement does not include the following condition:\n\n```\n\"Condition\": {\n    \"BoolIfExists\": {\n        \"ssm:SessionDocumentAccessCheck\": \"true\"\n    }\n}\n```\n\nAs a result, the `basti connect` minimal policy is logically identical to:\n\n```\n {\n      \"Effect\": \"Allow\",\n      \"Action\": \"ssm:StartSession\",\n      \"Resource\": [\n        \"arn:aws:ssm:*:*:document/AWS-StartPortForwardingSessionToRemoteHost\",\n        \"arn:aws:ssm:*:*:document/SSM-SessionManagerRunShell\",\n        \"arn:aws:ec2:\u003cyour-region\u003e:\u003cyour-account-id\u003e:instance/\u003cyour-basti-instance-id\u003e\"\n      ]\n    }\n```\n\nA `basti` admin would expect users under the minimal policy to be able to port forward. However, they could also get a shell on the bastion.\n\nFor more details on this footgun, see: https://ramimac.me/ssm-iam\n\n### PoC\n_Complete instructions, including specific configuration details, to reproduce the vulnerability._\n\n### Impact\n\nImpact would depend on configuration/hardening of the bastion. I've seen examples where bastions have credentials to downstream systems in configuration or memory that would be exposed. ","modified":"2023-08-24T12:53:06Z","published":"2023-08-24T12:53:06Z","database_specific":{"nvd_published_at":null,"cwe_ids":[],"severity":"LOW","github_reviewed":true,"github_reviewed_at":"2023-08-24T12:53:06Z"},"references":[{"type":"WEB","url":"https://github.com/BohdanPetryshyn/basti/security/advisories/GHSA-q4pp-j36h-3gqg"},{"type":"WEB","url":"https://github.com/BohdanPetryshyn/basti/commit/f6f218e7cd450e29aeb616960b7abbe8dfc87796"},{"type":"PACKAGE","url":"https://github.com/BohdanPetryshyn/basti"}],"affected":[{"package":{"name":"basti-cdk","ecosystem":"npm","purl":"pkg:npm/basti-cdk"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/08/GHSA-q4pp-j36h-3gqg/GHSA-q4pp-j36h-3gqg.json"}}],"schema_version":"1.9.0"}