0

My understanding of containers is very basic and so is my understanding of AWS EC2. Recently while trying to debug a security issue, I came across a scenario where I was able to gain an RCE. Whether this RCE was in a container or on the EC2 is still not clear. But one thing of interest was that through the RCE I was able to access the EC2 metadata endpoint at

curl http://169.254.169.254/latest/meta-data/iam/security-credentials/

Now I have a couple of conceptual questions here:

  1. How come from within a container I am able to access the EC2 metadata?
  2. Does it mean that the EC2 can also be accessed from within the container (like a container escape of some sorts)?
  3. I have access to the STS token, the access key id and the access key secret leaking through the metadata endpoint. How can I check the privileges of this token?
11
  • 1
    what is the purpose of your 1st and 2nd questions, since you don't know whether the RCE executed the command from the container or the hosting EC2 instance?
    – user284677
    Commented Dec 16, 2022 at 11:32
  • I am not sure whether it was executed from within the container or not. I am suspecting that it was from within the container though, because of some indications, like proc/1/cgroup shows some of the cgroups belonging to Docker. But since I was able to access the EC2 metadata, I am confused now. And hence all 3 of my questions. @Spyros
    – qre0ct
    Commented Dec 16, 2022 at 12:06
  • are you using a container orchestration platform (e.g. kubernetes) or plain docker images executing in EC2 instances?
    – user284677
    Commented Dec 16, 2022 at 12:25
  • why should you not be able to access this address from inside the container? what do you suppose would stop you from doing so? Commented Dec 16, 2022 at 13:27
  • 1
    @qre0ct I can access security.stackexchange.com even though I'm not on the same network segment. I am not sure how Docker sets up networking but I assume it wants your container to be able to access the Internet, so any requests to addresses that aren't special Docker addresses will just go out from the host. Commented Dec 22, 2022 at 19:45

0

You must log in to answer this question.

Browse other questions tagged .