Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Gaining Persistency on Vulnerable Lambdas

Summary: Unit 42 researchers showed that an attacker with remote code execution in an AWS Lambda function can replace the runtime's bootstrap process with a malicious copy, letting them intercept every subsequent invocation handled by that instance. They demonstrated the attack against a Lambda running PyYAML v3.13, exploiting CVE-2017-18432 in yaml.load(), and used a tool called SPLASH to replace bootstrap.py via os.execv, with the new runtime forwarding each event to an external server.

What you should know: AWS keeps Lambda instances alive for roughly 10-15 inactive minutes and reuses them for later requests, so one exploited function can quietly collect data from invocations the attacker never touched. The runtime swap takes about 2 seconds, which can be mistaken for a cold start, and AWS treats a flaw in your handler or its modules as your responsibility under the shared responsibility model.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Vulnerabilities & Patching
Related