Security researchers at DataDog have uncovered a significant vulnerability in Amazon Web Services (AWS) dubbed “whoAMI,” which enables unauthorized access to AWS accounts through manipulated Amazon Machine Images (AMIs).

The Vulnerability Explained
The whoAMI attack exploits misconfigured AMI selection processes in AWS environments, specifically targeting:
– EC2:DescribeImages API calls without owner specification
– Use of wildcards in scripts instead of specific AMI IDs
– Infrastructure-as-code tools using “most_recent=true” parameter

Attack Mechanism
Attackers can publish malicious AMIs with names mimicking trusted sources in the AWS marketplace. Without proper owner verification, systems may automatically select these compromised AMIs, potentially leading to code execution within target AWS accounts.

Impact and Scope
According to DataDog’s analysis:
– Approximately 1% of monitored organizations are vulnerable
– Thousands of AWS accounts potentially affected
– No customer data compromised outside research testing

Amazon’s Response
AWS implemented several security measures:
– Patched the vulnerability in September 2023
– Introduced ‘Allowed AMIs’ security control in December 2023
– Added features to create trusted AMI provider lists

Mitigation Steps
Organizations should:
– Specify AMI owners when using ec2:DescribeImages API
– Enable ‘Allowed AMIs’ feature
– Update configuration code for AMI sources
– Audit existing AMI usage
– Implement AWS Audit Mode for monitoring
– Use DataDog’s scanner tool for vulnerability assessment

The vulnerability highlights the importance of proper AMI source verification and the need for regular security audits in cloud environments.