I am writing a research paper detailing the security vulnerabilities of serverless AWS lambda applications, and how to prevent them. I am also compiling a list of security auditing tools that are designed to target serverless lambda applications.
I am trying to compile an exhaustive list of known lambda specific vulnerabilities, common mistakes (such as AWS lax permission policies), and how to prevent or mitigate against them. So far I have:
Remote command injection is possible, particularly if data is not sanitized correctly.
Leaked AWS credentials also obviously affect lambda as well, this is a very common mistake (such as credentials stashed in git commits, as demonstrated on flaws.cloud)
API Gateway is always publicly accessible, so we need to take the necessary precautions to secure access to our internal APIs, preferably with IAM roles.
Lambda costs incurred during a DoS attack ("cost attacks")
- Functions often are given more permissions than necessary which can lead to compromise
- Unused functions accidentally, or lazily left around can turn into attack surfaces.
- From rhino security labs aws writeup:
- It is possible to pass a new role to a lambda function and then invoke it.
- It is possible to pass a role to a new Lambda function and trigger it with DynamoDB
- It is possible to modify the code of an existing lambda function and exploit it
For tools used to audit AWS, so far I have found quite a few:
I am trying to make the list if known Lambda-specific vulnerabilities & common mistakes as exhaustive as possible. Personally I am not terribly experienced with AWS or Lambda, so I wanted to ask those of you in the security community that have real world experience deploying, maintaining, and/or auditing Lambda applications:
What are the most common mistakes that administrators make when deploying lambda applications, and how can they be prevented?
What are some common vulnerabilities specifically having to do with lambda instances running Python code, and how can they be avoided? (Interested to hear about other languages as well)
Has anyone with experience administering lambda encountered a scenario involving any of the vulnerabilities on my list? I would love to hear your story.
What else should I add to these lists?
Essentially I am asking for help making these lists as exhaustive as possible; particular the list of vulnerabilities. Real world experience and examples would be much appreciated. The main question is: What am I missing?
