When a Zero Day and Access Keys Collide in the Cloud: Responding to the SugarCRM Zero-Day Vulnerability
Summary: Unit 42 responded to multiple cases in which the SugarCRM zero-day CVE-2023-22952, an authentication bypass and remote code execution flaw published by NIST on Jan. 11, 2023 with a base score of 8.8, served as the initial access vector into AWS accounts. Attackers used the flaw to reach EC2 hosts holding long-term AWS access keys in plain text, then ran GetCallerIdentity, scanned with Pacu and Scout Suite, called Organizations and Cost and Usage APIs, created RDS snapshots and public databases, and built new EC2 instances in other regions.
Bottom line: The attackers reached the cloud through a web application flaw and plain-text credentials on the host, not through AWS itself, and in cases without VPC flow logs enabled Unit 42 could not determine how much data left the environment.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2023-22952
- Related
- CVE-2023-22952: Multiple SugarCRM Products Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Feb 02, 2023New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026