Researcher Details Vulnerabilities Found in AWS API Gateway

AWS fixed the security flaws that left the API service at risk of so-called HTTP header-smuggling attacks, says the researcher who discovered them.

BLACK HAT EUROPE 2021 — London — All it took was a space between characters and a few random letters, and Web researcher Daniel Thatcher was able to modify the HTTP header sent to Amazon API Gateway.
AWS API Gateway is a popular managed service for developers to write, manage, and secure their application programming interfaces (APIs) in a Web environment. At this weeks Black Hat Europe, Thatcher, researcher and penetration tester at Intruder, demonstrated how he found flaws in the service that allowed him to bypass the API Gateways IP address restrictions and wage a cache-poisoning attack using so-called HTTP header-smuggling.
Header-smuggling is a technique in which an attacker dupes a front-end server into sneaking malicious or phony information to the back-end server within the HTTP header, for example. HTTP (and HTTPS) headers carry information such as the clients browser, cookies, and IP address, as well as the requested Web page.
Thatcher told Dark Reading he was able to easily modify the HTTP header merely by typing a space in the header name and then some random letters. Specifically, he added X-Forwarded-For abcd: z to the header for HTTP requests, which bypassed the AWS IP address restriction policies in AWS API Gateway.
The front-end server tries to strip out invalid headers, but it cant see the modified header, so it slips to the back-end server, he explains.
While the IP address restrictions bypass hack using HTTP header-smuggling were relatively simple to execute, he says it would be hard for an attacker to exploit because they would need to have some knowledge or insight into a targets whitelisted IP addresses. AWS quickly fixed the IP restriction bypass flaw after he reported it, Thatcher says.
But Thatcher later found a second hole in AWS API Gateway that allowed him to use HTTP header-smuggling to sneak phony headers to the back end and employ a cache poisoning attack on the server, which he explains could let an attacker create their own API and return malicious content. The attacker then could overwrite entries in the victims server cache and wrest control of the content of the API. AWS has since fixed the second vulnerability, Thatcher says.
As of this posting, AWS had not responded to a request for comment about the API Gateway vulnerabilities and fixes.
Free Hacking Tool
Thatcher today also will release
a free, open source tool
for testing Web servers for weaknesses that could allow an attacker to pull off an HTTP header-smuggling attack. The tool, which Thatcher built using researcher James Kettles Param Miner Burp Suite toolkit, looks for header mutations that could leave the door open for HTTP header-smuggling. It provides a way for researchers to smuggle various headers through to the back-end server.
Besides scanning for HTTP header-smuggling weaknesses, other ways to protect against this attack include ensuring front-end servers cant forward unconventionally formatted headers like Thatcher was able to do, and ensuring the back-end server is more particular about the HTTP requests it accepts.
Thatchers
research
likely only scratches the surface of how header smuggling can root out Web vulnerabilities, he warns. Other vulnerabilities are likely to be found.

Last News
▸ 7 arrested, 3 more charged in StubHub cyber fraud ring. ◂ Discovered: 23/12/2024 Category: security	▸ Nigerian scammers now turning into mediocre malware pushers. ◂ Discovered: 23/12/2024 Category: security	▸ Beware EMV may not fully protect against skilled thieves. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Researcher Details Vulnerabilities Found in AWS API Gateway