Octopus Storage is a vulnerable web application, bundled with the series of AWS Cognito Security research articles, available at LSG Europe website. Octopus Storage is a cloud file hosting service that enables users to upload and share files. It is built as a server-less web application, and uses common AWS services with the help of frontend AWS JS SDK and Cognito service.
- Install terraform
- Configure an administrator-level AWS credentials for terraform to use
- Clone the repo and deploy it:
git clone https://github.com/adeadfed/octopus-storage
cd octopus-storage
cd tf
terraform init
terraform apply
- Terraform should yield the URLs for the freshly deployed web applications after the apply:
ubuntu@ubuntu:~$ terraform apply
...
Outputs:
octopus_admin_ssh_key = <sensitive>
octopus_admin_user_credentials = <sensitive>
octopus_admin_web_url = "http://EC2-PUBLIC-IP.compute-1.amazonaws.com"
octopus_storage_web_url = "https://CLOUDFRONT-ID.cloudfront.net"
- Sensitive terraform outputs You can access sensitive outputs like so:
terraform output -raw *output_name*
octopus_admin_ssh_key can be used to access the EC2 running the Octopus Admin web app.
octopus_admin_user_credentials can be used to log into octopus_admin User Pool user.
- Editable custom User Pool attributes that lead to a privilege escalation (use Flask app in
user-pool-attributes-app/app.py). - SSTI in developer application with server-side login flow that can be used leak developer credentials.
- RCE in User Pool Lambda trigger that can be abused to perform privileged actions on Cognito service or achieve a foothold in the infrastructure.
- Shared User Pool used to authenticate to multiple applications.
- Flawed rule-based role mapping that can be bypassed to obtain administrator credentials (optional; swap from option 1 to option 2 in lines 110-130 in
cognito.tf). - Misconfigured Identity Pool role permissions for horizontal privilege escalation.
- Misconfigured Identity Pool role permissions for vertical privilege escalation via excessive AWS Cognito permissions.