0

My understanding of containers is very basic and so is my understanding of AWS EC2. Recently while trying to debug a security issue, I came across a scenario where I was able to gain an RCE. Whether this RCE was in a container or on the EC2 is still not clear. But one thing of interest was that through the RCE I was able to access the EC2 metadata endpoint at

curl http://169.254.169.254/latest/meta-data/iam/security-credentials/

Now I have a couple of conceptual questions here:

  1. How come from within a container I am able to access the EC2 metadata?
  2. Does it mean that the EC2 can also be accessed from within the container (like a container escape of some sorts)?
  3. I have access to the STS token, the access key id and the access key secret leaking through the metadata endpoint. How can I check the privileges of this token?
Improve this question
11
  • 1
    what is the purpose of your 1st and 2nd questions, since you don't know whether the RCE executed the command from the container or the hosting EC2 instance?
    – user284677
    Dec 16, 2022 at 11:32
  • I am not sure whether it was executed from within the container or not. I am suspecting that it was from within the container though, because of some indications, like proc/1/cgroup shows some of the cgroups belonging to Docker. But since I was able to access the EC2 metadata, I am confused now. And hence all 3 of my questions. @Spyros
    – qre0ct
    Dec 16, 2022 at 12:06
  • are you using a container orchestration platform (e.g. kubernetes) or plain docker images executing in EC2 instances?
    – user284677
    Dec 16, 2022 at 12:25
  • why should you not be able to access this address from inside the container? what do you suppose would stop you from doing so?
    – user253751
    Dec 16, 2022 at 13:27
  • 1
    @qre0ct I can access security.stackexchange.com even though I'm not on the same network segment. I am not sure how Docker sets up networking but I assume it wants your container to be able to access the Internet, so any requests to addresses that aren't special Docker addresses will just go out from the host.
    – user253751
    Dec 22, 2022 at 19:45

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .